fix: address code review issues with Docker setup

- .gitignore: whitelist Dockerfile, docker-compose.yml, docker/ so they
  are actually tracked (the * catch-all was silently dropping them)
- Dockerfile: build and ship the archivr CLI alongside archivr-server so
  users can run `archivr init` inside the container on first setup
- docker/config.example.toml: fix archive_path to point at the .archivr
  subdirectory that archivr init creates (not the parent directory), which
  is what read_archive_paths expects
- docs/README.md: replace the bare mkdir quickstart step with
  `archivr init`, explain why mkdir is insufficient; add a callout that
  auth_db_path must be set explicitly to a writable path when the config
  mount is read-only

Dockerfile

@@ -0,0 +1,97 @@
+# syntax=docker/dockerfile:1
+
+###############################################################################
+# Stage 1 – Build the Rust server and CLI binaries
+###############################################################################
+FROM rust:1.87-slim-bookworm AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config \
+    libssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+# Layer the dependency build separately for better cache reuse.
+# Stub out every crate so Cargo can resolve and compile all dependencies
+# before we copy the real source.
+COPY Cargo.toml Cargo.lock ./
+COPY crates/archivr-core/Cargo.toml   crates/archivr-core/Cargo.toml
+COPY crates/archivr-server/Cargo.toml crates/archivr-server/Cargo.toml
+COPY crates/archivr-cli/Cargo.toml    crates/archivr-cli/Cargo.toml
+
+RUN mkdir -p \
+        crates/archivr-core/src \
+        crates/archivr-server/src \
+        crates/archivr-cli/src \
+    && touch crates/archivr-core/src/lib.rs \
+    && echo 'fn main() {}' > crates/archivr-server/src/main.rs \
+    && echo 'fn main() {}' > crates/archivr-cli/src/main.rs \
+    && cargo build --release -p archivr-server -p archivr-cli || true
+
+# Build the real binaries; touch source files to force Cargo to relink.
+COPY crates/ crates/
+RUN touch \
+    crates/archivr-core/src/lib.rs \
+    crates/archivr-server/src/main.rs \
+    crates/archivr-cli/src/main.rs \
+    && cargo build --release -p archivr-server -p archivr-cli
+
+###############################################################################
+# Stage 2 – Runtime image
+###############################################################################
+FROM debian:bookworm-slim
+
+# Runtime dependencies:
+#   chromium              used by single-file-cli for full-page archiving
+#   nodejs + npm          runtime for single-file-cli
+#   python3 + pip + venv  twitter scraper
+#   ca-certificates       outbound HTTPS from the server
+#   libssl3               OpenSSL linked by the Rust binary
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    chromium \
+    nodejs \
+    npm \
+    python3 \
+    python3-pip \
+    python3-venv \
+    ca-certificates \
+    libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install single-file-cli globally so `single-file` is on PATH.
+RUN npm install -g single-file-cli
+
+# Install yt-dlp and twitter-api-client into an isolated venv to avoid
+# conflicts with Debian's system Python packages.
+RUN python3 -m venv /opt/archivr-venv \
+    && /opt/archivr-venv/bin/pip install --no-cache-dir \
+        yt-dlp \
+        twitter-api-client
+
+# Server and CLI binaries (CLI is needed to run `archivr init` on first setup)
+COPY --from=builder /build/target/release/archivr-server /usr/local/bin/archivr-server
+COPY --from=builder /build/target/release/archivr       /usr/local/bin/archivr
+
+# Pre-built frontend assets (already compiled; no Vite build step needed)
+COPY crates/archivr-server/static/ /usr/share/archivr-server/static/
+
+# Twitter scraper script
+COPY vendor/twitter/scrape_user_tweet_contents.py \
+     /usr/local/lib/archivr/scrape_user_tweet_contents.py
+
+# Wire up env vars that the server (and archivr-core) read at runtime.
+# ARCHIVR_BIND and ARCHIVR_TWITTER_CREDENTIALS_FILE are intentionally left
+# unset here — set them in docker-compose.yml or at `docker run` time.
+ENV ARCHIVR_STATIC_DIR=/usr/share/archivr-server/static \
+    ARCHIVR_CHROME=/usr/bin/chromium \
+    ARCHIVR_SINGLE_FILE=/usr/local/bin/single-file \
+    ARCHIVR_TWEET_PYTHON=/opt/archivr-venv/bin/python3 \
+    ARCHIVR_TWEET_SCRAPER=/usr/local/lib/archivr/scrape_user_tweet_contents.py \
+    ARCHIVR_YT_DLP=/opt/archivr-venv/bin/yt-dlp
+
+EXPOSE 8080
+
+# Expects the TOML config at /config/archivr-server.toml (mount a volume).
+# Copy docker/config.example.toml as a starting point.
+ENTRYPOINT ["archivr-server", "/config/archivr-server.toml"]