Add docker-compose stack: app + Caddy reverse proxy with automatic TLS

Caddy's site address comes from SITE_ADDRESS (defaults to "localhost").
Left at that default, Caddy detects it isn't a public hostname and
issues a self-signed cert from its own internal CA — no domain needed
for local/dev testing. Set to a real domain, it gets a genuine Let's
Encrypt certificate automatically instead.

DB, encrypted master key and logs are bind-mounted from ./data/ on the
host (not opaque Docker-managed volumes), so they survive container
restarts/rebuilds and stay reachable for manual inspection/backup
directly from the repo root. ./data/ is gitignored.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitignore

@@ -7,3 +7,4 @@ master.xprv.enc
 .pytest_cache/
 *.egg-info/
 logs/
+data/

Caddyfile

@@ -0,0 +1,11 @@
+# SITE_ADDRESS is the domain to serve (e.g. lottery.example.com) — Caddy
+# automatically requests a Let's Encrypt certificate for it.
+#
+# Left at the default "localhost" (dev mode, no domain), Caddy detects it's
+# not a public hostname and issues a locally-trusted self-signed certificate
+# instead, via its internal CA. Browsers will still warn on first visit
+# unless that CA is explicitly trusted — expected for local/dev use.
+{$SITE_ADDRESS:localhost} {
+	encode gzip
+	reverse_proxy app:8123
+}

docker-compose.yml

@@ -0,0 +1,33 @@
+services:
+  app:
+    build: .
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      - DATABASE_URL=sqlite+aiosqlite:////app/db_data/plm_lottery.db
+      - MASTER_KEY_PATH=/app/key_data/master.xprv.enc
+    volumes:
+      - ./data/db:/app/db_data
+      - ./data/keys:/app/key_data
+      - ./data/logs:/app/logs
+    expose:
+      - "8123"
+
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      - SITE_ADDRESS=${SITE_ADDRESS:-localhost}
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - app
+
+volumes:
+  caddy_data:
+  caddy_config: