deploy: add Dockerfile, fix gunicorn bind to 0.0.0.0

Dockerfile

@@ -0,0 +1,22 @@
+FROM python:3.13-slim
+
+# Non-root user for security
+RUN useradd --system --create-home --home-dir /app checkpoint
+
+WORKDIR /app
+
+# Dependencies first (layer caching — reinstall only when requirements change)
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# App code
+COPY . .
+
+# instance/ is a Docker volume — just ensure the directory exists with right owner
+RUN mkdir -p instance/uploads && chown -R checkpoint:checkpoint /app
+
+USER checkpoint
+
+EXPOSE 8000
+
+CMD ["gunicorn", "-c", "gunicorn.conf.py", "wsgi:app"]

gunicorn.conf.py

@@ -5,7 +5,7 @@ Start (über systemd, siehe deploy/checkpoint.service):
 """
 
 # Nur lokal lauschen – nginx ist der öffentliche Eingang (Reverse Proxy).
-bind = "127.0.0.1:8000"
+bind = "0.0.0.0:8000"
 
 # Klein halten: 17 Nutzer, ein VPS. Mehrere Worker sind dank SQLite-WAL ok.
 workers = 3