chore: 增加 Docker 单容器部署

生产用 Dockerfile + compose 嵌入前端二进制，run.sh docker 一键构建启动。

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -0,0 +1,66 @@
+# opsx-licence — 前端嵌入 Go 单二进制，Docker 部署
+# Stage 1: Node 构建 Vue
+# Stage 2: Go(+CGO) 嵌入 static 并编译
+# Stage 3: 精简运行时
+# 署名 Logan.Li
+
+# ==================== Stage 1: Frontend ====================
+FROM node:20-bookworm-slim AS frontend-builder
+
+WORKDIR /frontend
+ENV NODE_OPTIONS="--max-old-space-size=2048"
+RUN npm config set registry https://registry.npmmirror.com
+
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+
+COPY frontend/ ./
+RUN npm run build
+
+# ==================== Stage 2: Backend ====================
+FROM golang:1.24-bookworm AS backend-builder
+
+WORKDIR /src
+ENV GOPROXY=https://goproxy.cn,direct
+ENV CGO_ENABLED=1
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      gcc libc6-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY backend/go.mod backend/go.sum ./
+RUN go mod download
+
+COPY backend/ ./
+RUN rm -rf static && mkdir -p static
+COPY --from=frontend-builder /frontend/dist/. ./static/
+
+RUN go build -trimpath -ldflags="-s -w" -o /out/opsx-licence .
+
+# ==================== Stage 3: Runtime ====================
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates tzdata curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --system --uid 10001 --home-dir /app --shell /usr/sbin/nologin opsx
+
+ENV TZ=Asia/Shanghai \
+    PORT=9001 \
+    GIN_MODE=release \
+    DB_DRIVER=sqlite \
+    DB_NAME=/data/db.sqlite3
+
+WORKDIR /app
+COPY --from=backend-builder /out/opsx-licence /app/opsx-licence
+
+RUN mkdir -p /data && chown -R opsx:opsx /app /data
+USER opsx
+
+VOLUME ["/data"]
+EXPOSE 9001
+
+HEALTHCHECK --interval=15s --timeout=3s --start-period=10s --retries=5 \
+  CMD curl -fsS "http://127.0.0.1:${PORT}/health" || exit 1
+
+ENTRYPOINT ["/app/opsx-licence"]