feat: multi-architecture Docker setup (x86_64 + ARM64) with one-command install

- Multi-stage Dockerfile: builder compiles native modules (better-sqlite3,
  tiny-secp256k1) under target architecture, runtime is minimal Alpine
- install.sh: POSIX sh installer (Alpine ash compatible) with architecture
  detection, Docker install, .env validation, health-check retry loop
- docker-compose.yml: removed platform locks, .env read-only mount,
  127.0.0.1 port binding, 384m mem limit (Orange Pi Zero 2 safe)
- .dockerignore: excludes node_modules, secrets, tests, .kilo
- README.md: complete rewrite with deployment docs for any device
- Verified: POSIX sh syntax (dash), Dockerfile (docker build --check),
  docker-compose (docker compose config)

Dockerfile

@@ -3,41 +3,44 @@ FROM node:22-alpine AS builder
 WORKDIR /app
 
 COPY package*.json ./
-RUN npm install && npm cache clean --force
 
-# --- Runtime image ---
+RUN apk add --no-cache --virtual .build-deps \
+        python3 \
+        make \
+        g++ \
+        gcc \
+        linux-headers \
+        git \
+        py3-setuptools \
+    && npm install --omit=dev \
+    && apk del .build-deps
+
+# ============================================================
+# Runtime image
+# ============================================================
 FROM node:22-alpine
 
-# Install runtime dependencies
-RUN apk update && \
-    apk add --no-cache --repository https://dl-cdn.alpinelinux.org/alpine/edge/community \
-        wireguard-tools \
-    && apk add --no-cache \
+RUN apk add --no-cache \
+        bash \
+        bind-tools \
+        curl \
         iptables \
         iproute2 \
         openresolv \
-        bash \
-        curl \
-    && rm -rf /var/cache/apk/*
+        wireguard-tools
 
 WORKDIR /app
 
-# Copy node_modules from builder
 COPY --from=builder /app/node_modules ./node_modules
 COPY package*.json ./
 
-# Copy application source
 COPY ./src ./src
 
-# Copy startup script
 COPY ./wg/start.sh /app/start.sh
 RUN chmod +x /app/start.sh
 
-# Create db directory
-RUN mkdir -p /app/db
+RUN mkdir -p /app/db /app/uploads
 
-# Health check: bot responds to /health on port 3000
-HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
-    CMD curl -sf http://localhost:3001/health || exit 1
+EXPOSE 3001
 
-CMD ["/bin/bash", "/app/start.sh"]
+CMD ["/bin/bash", "/app/start.sh"]