Add Docker deploy config for VPS (node-server + Traefik)

- Dockerfile: bun build with Nitro node-server preset -> standalone Node runner
- docker-compose.yml: Traefik labels for automatic HTTPS, runtime env from .env
- .dockerignore + DEPLOY.md (Hostinger VPS: Docker + Dockge + Traefik steps)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

DEPLOY.md

@@ -0,0 +1,80 @@
+# Deploying to a Hostinger VPS (Docker + Dockge + Traefik)
+
+This app is a TanStack Start (SSR) app. The Docker build produces a self-contained
+Node server (`.output/server/index.mjs`) via the Nitro `node-server` preset and runs
+it in a container. Traefik sits in front and gives it automatic HTTPS.
+
+## 0. One-time: install the catalog apps
+
+From hPanel → VPS → your server → **Catalog**, install:
+
+1. **Docker** (base engine)
+2. **Traefik** (reverse proxy + Let's Encrypt HTTPS)
+3. **Dockge** (web UI to manage compose stacks + logs)
+
+## 1. Point your domain at the VPS
+
+In your DNS (Hostinger → Domains → DNS), add an **A record** for the subdomain you
+want (e.g. `app.yourdomain.com`) pointing at the VPS's public IP. Wait for it to
+resolve before step 4 (Let's Encrypt needs it).
+
+## 2. Find your Traefik values
+
+The compose file has 3 placeholders to match to your Traefik install. On the VPS:
+
+```bash
+# Traefik's docker network name (what to put for the `traefik` network):
+docker network ls | grep -i traefik
+
+# Traefik's entrypoint + certresolver names (look in its config/labels):
+docker inspect traefik | grep -iE "entrypoints|certresolver|acme"
+```
+
+Typical values are network `traefik`, entrypoint `websecure`, resolver `letsencrypt`,
+but **use whatever your install shows.** Edit `docker-compose.yml` accordingly and set
+your real domain in the `Host(...)` rule.
+
+## 3. Get the code onto the VPS as a Dockge stack
+
+Dockge watches `/opt/stacks`. Clone the repo into a stack folder:
+
+```bash
+cd /opt/stacks
+git clone https://github.com/renee-png/info-share-spot.git
+```
+
+The committed `.env` already holds the (public-safe) `SUPABASE_URL` and
+`SUPABASE_PUBLISHABLE_KEY` that compose passes to the container at runtime.
+
+## 4. Deploy in Dockge
+
+1. Open Dockge → the `info-share-spot` stack appears automatically.
+2. Confirm the 3 edited Traefik labels + domain look right.
+3. Click **Deploy** (this runs `docker compose up -d --build`).
+
+First build takes a few minutes (installs deps + builds). When it's up, visit
+`https://app.yourdomain.com` — Traefik will have issued the TLS cert.
+
+## 5. Create your admin account
+
+The database (Supabase EDU project) is already migrated and empty, so the **first**
+account you create at `/auth → Create account` becomes the **admin**.
+
+## Updating later
+
+```bash
+cd /opt/stacks/info-share-spot
+git pull
+```
+
+Then in Dockge hit **Deploy** again (rebuilds the image and restarts). That's your
+push-to-server loop: `git push` locally → `git pull` + Deploy on the VPS.
+
+## Notes
+
+- **Google sign-in** still needs the Google provider enabled in the Supabase EDU
+  dashboard (Auth → Providers) and your production URL added under Auth → URL
+  Configuration. Email/password works without any of that.
+- **Container port** is 3000 (Traefik routes to it; you don't expose it publicly).
+- **Service-role key**: not required. If you later use the server-side admin client,
+  add `SUPABASE_SERVICE_ROLE_KEY` via Dockge's env editor — never commit it.