Dockerize scha + Gitea CI/CD auto-deploy via server-infra (#21)

## Summary
- Dockerize SCHA Wheaton (uv packaging, Dockerfile, compose, entrypoint) and move secrets/DB config to env-driven `scha/settings/`.
- Add Gitea Actions: unit tests on push/PR to `master`, auto-deploy on green master push via `server-infra/scripts/deploy.sh --app scha --env prod`.
- Prod compose uses shared external Postgres only (no bundled DB); control-node secret template at `.env.prod.example`.

Closes #19 (Part A). Depends on companion server-infra PR for catalog/host_apps registration.

## Test plan
- [ ] `uv sync --frozen` + `DJANGO_ENV=dev DJANGO_SECRET_KEY=test uv run python manage.py check`
- [ ] `docker compose build` succeeds locally
- [ ] `docker compose up` serves app against bundled Postgres
- [ ] `./scripts/validate-env.sh ~/Documents/secrets/scha/scha_prod.env` passes
- [ ] After merge + server-infra catalog live: push to master runs Unit Tests then Deploy

Reviewed-on: #21

README.md

@@ -1,3 +1,78 @@
-# scha
+# SCHA Wheaton
 
-Django site for SCHA
+Django site for SCHA Wheaton. Packaging via `uv`; production deploy via `server-infra`.
+
+## Local development
+
+### Prerequisites
+
+- Python 3.12+
+- [uv](https://docs.astral.sh/uv/)
+- Docker + Docker Compose (optional, recommended)
+
+### uv (host)
+
+```bash
+cp .env.example .env
+uv sync
+uv run python manage.py migrate
+uv run python manage.py runserver
+```
+
+Without `DATABASE_URL` / `DB_HOST`, settings fall back to SQLite (`db.sqlite3`).
+
+### Docker (dev, bundled Postgres)
+
+```bash
+docker compose up --build
+```
+
+App: http://localhost:8000 — Postgres via `DATABASE_URL=postgres://scha:scha@db:5432/scha`.
+
+## Environment variables
+
+| Variable | Dev default | Prod required | Notes |
+|----------|-------------|---------------|-------|
+| `DJANGO_ENV` | `dev` | `prod` / `beta` | Selects settings module |
+| `DJANGO_SECRET_KEY` | insecure default | yes | Must be set in prod |
+| `DJANGO_DEBUG` | env default / true in `dev` | `false` | |
+| `DJANGO_ALLOWED_HOSTS` | `*` | yes | Comma-separated |
+| `DJANGO_CSRF_TRUSTED_ORIGINS` | derived from hosts | optional | Comma-separated full origins |
+| `DATABASE_URL` | SQLite fallback | yes | Shared Postgres in prod |
+| `WEB_PORT` | n/a (compose) | `8002` | Host port for prod compose |
+| `STRIPE_*` | empty | yes (prod/beta) | Publishable, secret, webhook |
+| `RECAPTCHA_*` | empty | yes (prod/beta) | Public + private |
+
+Templates: `.env.example` (local), `.env.prod.example` (control-node secret).
+
+Control-node secret path (server-infra):
+
+```text
+~/Documents/secrets/scha/scha_prod.env
+```
+
+Validate with:
+
+```bash
+./scripts/validate-env.sh ~/Documents/secrets/scha/scha_prod.env
+```
+
+## Production (docker-compose.prod.yml)
+
+- Single `web` service; **no** bundled DB — `DATABASE_URL` points at shared Postgres (`10.0.0.230`).
+- Host port from `WEB_PORT` (catalog: **8002**).
+- Deployed by `server-infra/scripts/deploy.sh --app scha --env prod --ref <sha>`.
+
+## CI / CD (Gitea Actions)
+
+| Workflow | Trigger | Action |
+|----------|---------|--------|
+| `unittests.yml` | push + PR → `master` | `uv sync` + `manage.py test` |
+| `ci.yml` | PR → `master` | same unit tests |
+| `deploy.yml` | after Unit Tests succeeds on `master` **push** | docker build/test → `deploy.sh` |
+
+Deploy never runs on PRs.
+
+## Security note
+
+Stripe and reCAPTCHA keys previously lived in `settings.py`. Treat them as compromised; rotate and set real values only in the control-node env file (never commit).