feat: Docker deployment + backup/restore + README

Production deployment (PRD §5.7):
- Dockerfile: multi-stage build (deps → build → runner), healthcheck
- docker-compose.yml: app + backup container + Caddy HTTPS proxy
  - Backup container: daily SQLite backup + SHA-256 checksum
  - Caddy: automatic HTTPS reverse proxy
  - Volumes: db, data, backups, caddy-data
- deploy/backup.sh: timestamped backup + checksum + retention cleanup
- deploy/restore.sh: checksum verification + pre-restore backup
- README.md: quick start (Docker + dev), architecture, modules, compliance, MCP

Verified:
- Backup script: creates aos_20261027.db + .sha256 ✓
- TypeScript: 0 errors, ESLint clean

deploy/restore.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# AOS Restore Script (PRD §5.7: restore drill)
+# Usage: ./deploy/restore.sh <backup_file>
+# Restores SQLite from a backup file, verifies SHA-256 checksum.
+set -eu
+
+BACKUP_FILE="${1:-}"
+DB_PATH="${DATABASE_URL:-file:/home/z/my-project/db/custom.db}"
+DB_FILE="${DB_PATH#file:}"
+
+if [ -z "$BACKUP_FILE" ]; then
+    echo "Usage: $0 <backup_file>"
+    echo ""
+    echo "Available backups:"
+    ls -lh /home/z/my-project/db/backups/aos_*.db 2>/dev/null || echo "  (none)"
+    exit 1
+fi
+
+if [ ! -f "$BACKUP_FILE" ]; then
+    echo "ERROR: Backup file not found: $BACKUP_FILE"
+    exit 1
+fi
+
+echo "=== AOS Restore ==="
+echo "  Backup: $BACKUP_FILE"
+echo "  Target: $DB_FILE"
+
+# Verify checksum if .sha256 exists
+SHA_FILE="${BACKUP_FILE}.sha256"
+if [ -f "$SHA_FILE" ]; then
+    echo ""
+    echo "=== Verifying SHA-256 checksum ==="
+    if sha256sum -c "$SHA_FILE" --quiet 2>/dev/null; then
+        echo "  ✓ Checksum verified"
+    else
+        echo "  ✗ Checksum FAILED — file may be corrupted"
+        read -p "  Continue anyway? (y/N) " -n 1 -r
+        echo
+        [[ ! $REPLY =~ ^[Yy]$ ]] && exit 1
+    fi
+fi
+
+# Stop app if running
+echo ""
+echo "=== Stopping app... ==="
+pkill -f "next dev" 2>/dev/null || true
+pkill -f "node server.js" 2>/dev/null || true
+sleep 2
+
+# Backup current DB
+if [ -f "$DB_FILE" ]; then
+    CURRENT_BACKUP="${DB_FILE}.pre-restore.$(date +%Y%m%d_%H%M%S)"
+    echo "=== Backing up current DB to $CURRENT_BACKUP ==="
+    cp "$DB_FILE" "$CURRENT_BACKUP"
+fi
+
+# Restore
+echo ""
+echo "=== Restoring... ==="
+cp "$BACKUP_FILE" "$DB_FILE"
+echo "  ✓ Database restored"
+
+# Verify
+echo ""
+echo "=== Verification ==="
+if [ -f "$DB_FILE" ]; then
+    SIZE=$(wc -c < "$DB_FILE")
+    echo "  File size: $SIZE bytes"
+    echo "  ✓ Restore complete. Run 'bun run dev' to start."
+else
+    echo "  ✗ ERROR: DB file not found after restore"
+    exit 1
+fi