chore(deploy): single-container Dockerfile, Caddy, and Unraid template

Builds the container the "1 container" decision (D15) actually needs, which
D15 itself deferred as follow-up work: Caddy + the FastAPI app + the static
SvelteKit build in one image, SQLite on a mounted volume. See docs/DECISIONS.md
D16 for the specific choices and why (entrypoint-run migrations instead of a
separate deploy-pipeline step, tini + a small supervisor script instead of
s6-overlay/supervisord, copying the Caddy binary out of its official image).

Removes apps/api/Dockerfile and apps/web/Dockerfile from the old 4-container
compose plan (PR #4, closed as superseded) — the root Dockerfile replaces both
with one multi-stage build.

deploy/unraid-template.xml turns VELODROME_PUBLIC_URL, VELODROME_SECRET_KEY,
etc. into fillable Unraid Community Applications web UI fields, per the
earlier decision to keep config there instead of a .env file.

.gitea/workflows/release.yml builds and pushes the image to the Gitea registry
on a version tag or manual dispatch; it does not touch the running container.

Verified by actually running the built image, not just building it: the
health endpoint responds through Caddy's proxy, the SPA serves with working
client-route fallback, alembic ran and produced a real (non-empty) SQLite file
under /data, the process runs as the non-root velodrome user, and killing the
uvicorn process brings the whole container down (exit 143) rather than
leaving Caddy serving alone — confirming the entrypoint's coupled-lifetime
behavior actually holds, not just that it reads correctly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R2ZKeWkZV7ehf7fivrAkkG

CLAUDE.md

@@ -17,8 +17,9 @@ say so and argue it — but don't silently contradict it.
 apps/api/           Python 3.12 / FastAPI / SQLAlchemy async / Alembic
 apps/web/           SvelteKit static SPA (installable PWA)
 packages/openapi/   openapi.json — COMMITTED contract artefact, CI enforces it matches the code
-deploy/             single-container Dockerfile, Caddyfile, systemd units, backup scripts —
-                    see docs/DECISIONS.md D15 for why this isn't docker-compose
+Dockerfile          single-container build (root, not deploy/ — needs both apps/api and apps/web
+                    as build context). See docs/DECISIONS.md D15/D16 for why one container.
+deploy/             Caddyfile, entrypoint.sh, unraid-template.xml, systemd backup units
 docs/               plan, decisions, research
 scripts/            repo tooling (PR helpers, etc.)
 .gitea/workflows/   CI