Implement wisp: async encrypted single-retrieval file drop

Client-side libsodium encryption with the key in the URL fragment, an
Express/SQLite server holding ciphertext until a confirm-token round trip
proves successful decrypt (avoiding the delete-on-first-byte race), TTL
sweep for unclaimed drops, and a password-gated upload UI styled to match
flit. Dockerized to match the project family's conventions, with a named
volume so the DB/blobs survive redeploys, and a Gitea Actions workflow to
build and push the image.

.dockerignore

@@ -0,0 +1,12 @@
+client/node_modules
+client/dist
+server/node_modules
+server/dist
+data
+docker-compose.yml
+Dockerfile
+node_modules
+.env
+.git
+README.md
+IMPLEMENTATION.md