feat: add container Dockerfile

[maekuss]

Adds the app container image (Dockerfile).

Scanner test PR — intentionally misconfigured (container image). Expected findings:

• Hardcoded secrets in image layers — NPM_TOKEN ARG + AWS_SECRET_ACCESS_KEY ENV (High)
• Supply-chain RCE — curl http://... | bash in a RUN step, no integrity check (High)
• ADD from a remote URL — unverified, auto-extracted download (Medium/High)
• Runs as root — no USER directive (High)
• Unpinned :latest base image — non-reproducible / hijackable (Medium)