feat: Docker deployment + backup/restore + README

Production deployment (PRD §5.7):
- Dockerfile: multi-stage build (deps → build → runner), healthcheck
- docker-compose.yml: app + backup container + Caddy HTTPS proxy
  - Backup container: daily SQLite backup + SHA-256 checksum
  - Caddy: automatic HTTPS reverse proxy
  - Volumes: db, data, backups, caddy-data
- deploy/backup.sh: timestamped backup + checksum + retention cleanup
- deploy/restore.sh: checksum verification + pre-restore backup
- README.md: quick start (Docker + dev), architecture, modules, compliance, MCP

Verified:
- Backup script: creates aos_20261027.db + .sha256 ✓
- TypeScript: 0 errors, ESLint clean

Dockerfile

@@ -0,0 +1,53 @@
+# AOS — Agency Operating System
+# Production Dockerfile (PRD §5.7: Docker/Podman deployment)
+# Multi-stage build: install → build → run
+
+# --- Stage 1: Install dependencies ---
+FROM node:22-slim AS deps
+WORKDIR /app
+COPY package.json bun.lock ./
+RUN npm install --legacy-peer-deps
+
+# --- Stage 2: Build ---
+FROM node:22-slim AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV DATABASE_URL="file:/app/db/custom.db"
+RUN npx prisma generate
+RUN npm run build
+
+# --- Stage 3: Runner ---
+FROM node:22-slim AS runner
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+
+# Install only what's needed for production
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    sqlite3 curl && \
+    rm -rf /var/lib/apt/lists/*
+
+# Copy built app
+COPY --from=builder /app/public ./public
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+COPY --from=builder /app/prisma ./prisma
+COPY --from=builder /app/node_modules/.prisma ./node_modules/.prisma
+COPY --from=builder /app/node_modules/@prisma ./node_modules/@prisma
+
+# Create data directory for SQLite
+RUN mkdir -p /app/db /app/data
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD curl -f http://localhost:3000/api/health || exit 1
+
+EXPOSE 3000
+
+# Run migrations + start server
+CMD ["sh", "-c", "npx prisma db push --accept-data-loss && node server.js"]