Dockerize scha + Gitea CI/CD auto-deploy via server-infra (#21)

## Summary
- Dockerize SCHA Wheaton (uv packaging, Dockerfile, compose, entrypoint) and move secrets/DB config to env-driven `scha/settings/`.
- Add Gitea Actions: unit tests on push/PR to `master`, auto-deploy on green master push via `server-infra/scripts/deploy.sh --app scha --env prod`.
- Prod compose uses shared external Postgres only (no bundled DB); control-node secret template at `.env.prod.example`.

Closes #19 (Part A). Depends on companion server-infra PR for catalog/host_apps registration.

## Test plan
- [ ] `uv sync --frozen` + `DJANGO_ENV=dev DJANGO_SECRET_KEY=test uv run python manage.py check`
- [ ] `docker compose build` succeeds locally
- [ ] `docker compose up` serves app against bundled Postgres
- [ ] `./scripts/validate-env.sh ~/Documents/secrets/scha/scha_prod.env` passes
- [ ] After merge + server-infra catalog live: push to master runs Unit Tests then Deploy

Reviewed-on: #21

docker-compose.yml

@@ -0,0 +1,34 @@
+services:
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: scha
+      POSTGRES_USER: scha
+      POSTGRES_PASSWORD: scha
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U scha -d scha"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+      start_period: 10s
+
+  web:
+    build: .
+    ports:
+      - "8000:8000"
+    # No required env_file — CI has no .env. Defaults below; for local secrets:
+    #   docker compose --env-file .env up
+    environment:
+      DJANGO_ENV: ${DJANGO_ENV:-dev}
+      DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-dev-only-change-me}
+      DJANGO_DEBUG: ${DJANGO_DEBUG:-true}
+      DJANGO_ALLOWED_HOSTS: ${DJANGO_ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0}
+      DATABASE_URL: ${DATABASE_URL:-postgres://scha:scha@db:5432/scha}
+    depends_on:
+      db:
+        condition: service_healthy
+
+volumes:
+  postgres_data: