feat: add Django project scaffold, configuration and container

Environment-variable configuration that fails fast, database-only health
check, JSON request logs with a request id, security headers with a strict
CSP, and a multi-stage non-root Docker image with compose file. Ticket 1.1.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt

Dockerfile

@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1
+
+FROM python:3.13-slim AS builder
+COPY --from=ghcr.io/astral-sh/uv:0.13.1 /uv /usr/local/bin/uv
+ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never
+WORKDIR /app
+COPY pyproject.toml uv.lock .python-version README.md ./
+RUN uv sync --frozen --no-dev --no-install-project
+COPY manage.py ./
+COPY portal ./portal
+# Build-time only values so collectstatic can load settings; not used at runtime.
+RUN SECRET_KEY=build-time-only-value-not-used-at-runtime-000000 \
+    ALLOWED_HOSTS=localhost DATA_DIR=/tmp \
+    /app/.venv/bin/python manage.py collectstatic --noinput
+
+FROM python:3.13-slim
+ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 PATH="/app/.venv/bin:$PATH"
+RUN useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin app \
+    && mkdir /data /backups \
+    && chown app:app /data /backups
+WORKDIR /app
+COPY --from=builder /app /app
+COPY --chmod=0755 docker ./docker
+ENV DATA_DIR=/data
+USER app
+VOLUME ["/data", "/backups"]
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD ["python", "/app/docker/healthcheck.py"]
+ENTRYPOINT ["/app/docker/entrypoint.sh"]