feat: add Django project scaffold, configuration and container

Environment-variable configuration that fails fast, database-only health
check, JSON request logs with a request id, security headers with a strict
CSP, and a multi-stage non-root Docker image with compose file. Ticket 1.1.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt

docker/entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+python manage.py migrate --noinput
+
+exec gunicorn portal.config.wsgi:application \
+    --bind 0.0.0.0:8000 \
+    --workers 1 \
+    --threads 4 \
+    --preload \
+    --worker-tmp-dir /tmp \
+    --error-logfile -

docker/healthcheck.py

@@ -0,0 +1,16 @@
+"""Container health probe: GET /healthz with a host name the app accepts."""
+
+import os
+import sys
+import urllib.request
+
+hosts = [h.strip() for h in os.environ.get("ALLOWED_HOSTS", "").split(",") if h.strip()]
+host = hosts[0].lstrip(".") if hosts and hosts[0] != "*" else "localhost"
+request = urllib.request.Request(  # noqa: S310
+    "http://127.0.0.1:8000/healthz", headers={"Host": host}
+)
+try:
+    with urllib.request.urlopen(request, timeout=3) as response:  # noqa: S310
+        sys.exit(0 if response.status == 200 else 1)
+except Exception:  # noqa: BLE001
+    sys.exit(1)