Containerize for independent deployment

Adds a Dockerfile, nginx config, docker-compose.yml, and a Gitea Actions
workflow (mirroring goonk's), so rack builds and ships as its own image
rather than being embedded in goonk-cv's build - deploys stay fully
decoupled. Targets a subdomain, not a goonk.se subpath, to avoid needing
path-prefix rewriting kept in sync across the build, edge proxy, and
container.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -205,3 +205,39 @@
   project (`goonk`, `adventure`, etc.), which each have their own `.git`.
   Ran `git init` here to match that convention ahead of the eventual real
   deploy.
+
+## 2026-07-02 — containerize, decoupled from goonk-cv's own deploy
+
+- Corrected course from the previous entry: copying rack's build into
+  `goonk/public/rack/` would mean every rack change requires rebuilding
+  and redeploying goonk-cv's own image — exactly the coupling explicitly
+  ruled out ("I don't necessarily want to redeploy goonk-cv when updating
+  this"). `goonk-cv` is built as its own Docker image via Gitea Actions
+  and pulled to host independently of any other project's repo, so rack
+  needed the same shape, not a file dropped into goonk's build.
+- Added `Dockerfile` + `nginx/default.conf` (multi-stage: `node:24-alpine`
+  build → `nginx:alpine` static serve), mirroring `goonk`'s own Dockerfile
+  structure exactly, minus the `/admin` and `/api` proxy blocks it needs
+  and rack doesn't (no backend). Verified locally: `docker build` succeeds
+  and the resulting container serves the app correctly on a test port.
+- Added `.gitea/workflows/docker.yml`, copied from `goonk`'s workflow
+  (which already derives the registry image name from the repo path, so
+  no rack-specific edits were needed beyond dropping the `-api` build
+  step goonk has and rack doesn't). Requires a `TKNTKN` repo secret (Gitea
+  PAT, `packages:write`) to be added manually in this repo's settings —
+  not something settable from here.
+- Added `docker-compose.yml` (host-side reference, `image:
+  repo.explewd.com/explewd/rack:latest`) and `.env.example` for the
+  `HOST_PORT` override, matching `goonk`'s compose shape.
+- Decision: **subdomain, not `goonk.se/rack`.** Discussed both — a subpath
+  deployment needs the `--base=/rack/` build *and* the edge proxy to
+  forward `/rack/...` through unstripped *and* the container to serve
+  files at that same sub-path, three things that have to stay in sync. A
+  subdomain (`rack.explewd.com`) needs one DNS record and one new
+  `server_name`/proxy-host entry, with the app built completely vanilla —
+  same decoupled-deploy story, far less to keep synchronized. Kept
+  `npm run build:subpath` in `package.json` in case the subpath route is
+  wanted later, but it's not part of the current deploy path.
+- Host port: `5677`, matching the existing dev-server port for
+  memorability, mapped via `docker-compose.yml`'s `HOST_PORT` (defaults to
+  `5677`, override via `.env`).