Run the whole stack in Docker

- API and web images built with turbo prune; the API image also runs the
  worker and migrations. Non-root, health-checked, Debian slim.
- docker compose up -d --build starts Postgres, Redis (persistent), a
  one-shot migrate job, API, worker and web, in dependency order.
- Fix the API production build (tsup flags moved to a config file) and
  bundle the migration script; silence Postgres NOTICE noise.
- npm run infra:up now starts only Postgres and Redis for hot-reload dev.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

README.md

@@ -13,13 +13,23 @@ packages/
   shared/   Types, zod schemas, plan entitlements, streaming-link helpers
 ```
 
-## Running locally
+## Running with Docker (everything)
+
+```bash
+cp apps/api/.env.example apps/api/.env   # first time: set TOKEN_ENCRYPTION_KEY (openssl rand -base64 32)
+docker compose up -d --build             # Postgres, Redis, migrations, API, worker, web
+```
+
+Open http://localhost:3737. Logs: `docker compose logs -f api worker`. Stop: `docker compose down` (data is kept in volumes).
+Migrations run automatically before the API and worker start. A Jellyfin/Plex server on your machine is reachable from the containers as `host.docker.internal`.
+
+## Running for development (hot reload)
 
 Requires Node 22.13+ and Docker.
 
 ```bash
 npm install
-npm run infra:up                       # Postgres on :5447, Redis on :6380
+docker compose up -d postgres redis    # Postgres on :5447, Redis on :6380
 cp apps/api/.env.example apps/api/.env # then set TOKEN_ENCRYPTION_KEY (openssl rand -base64 32)
 cp apps/web/.env.example apps/web/.env.local
 npm run db:migrate