feat(maestro): Dockerfile for maestro-registry (Dokploy-ready)

Multi-stage build (rust:1-bookworm builder → debian:bookworm-slim
runtime) for the `maestro-registry` binary. Uses BuildKit cargo cache
mounts so subsequent rebuilds are fast.

Defaults `MAESTRO_REGISTRY_BIND_ADDR=0.0.0.0:8080` so the container
is reachable from a reverse proxy (Traefik, etc.) without any extra
config. Operator supplies `MAESTRO_TOKEN` as a platform secret; with
that set the binary needs no writable volume.

`.dockerignore` keeps `target/`, `worktrees/`, `.git/`, docs, and the
WIP `web/` out of the build context.

Verified: docker build succeeds; `docker run -e MAESTRO_TOKEN=...
-p 8080:8080 maestro-registry` boots and responds 200 on the cookie
auth endpoint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,9 @@
+target/
+worktrees/
+.git/
+.github/
+.claude/
+docs/
+web/
+*.md
+.env*

Dockerfile

@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1.7
+#
+# Image for the `maestro-registry` binary.
+#
+# Build:  docker build -t maestro-registry .
+# Run:    docker run --rm -p 8080:8080 -e MAESTRO_TOKEN=<secret> maestro-registry
+#
+# On Dokploy: point at this Dockerfile, expose port 8080 (or whatever you
+# set MAESTRO_REGISTRY_BIND_ADDR to), and set MAESTRO_TOKEN as a secret env.
+# No persistent volume is required when MAESTRO_TOKEN is provided.
+
+FROM rust:1-bookworm AS builder
+WORKDIR /build
+COPY . .
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/build/target \
+    cargo build --release -p maestro-registry \
+ && cp /build/target/release/maestro-registry /maestro-registry
+
+FROM debian:bookworm-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /maestro-registry /usr/local/bin/maestro-registry
+
+# Default to all-interfaces so Dokploy / Traefik can reach the service.
+# Override via env on the platform.
+ENV MAESTRO_REGISTRY_BIND_ADDR=0.0.0.0:8080
+EXPOSE 8080
+
+ENTRYPOINT ["/usr/local/bin/maestro-registry"]