Add full Docker deployment: setup.sh, update.sh, healthcheck, TURN support

- setup.sh: interactive/non-interactive one-shot installer (build, DB
  healthcheck, migrate, seed, start), idempotent secret generation, NPM
  reverse-proxy network auto-detection and optional join, optional
  AUTO_UPDATE cron install.
- update.sh: release-tag-gated updates only (never bare main), DB backup
  with retention before every update, lock file against concurrent runs,
  automatic code rollback on failed post-update healthcheck.
- Dockerfile: multi-stage build, non-root user, built-in HEALTHCHECK against
  the new /api/health route, wholesale COPY so new source dirs (e.g.
  scripts/) never silently go missing at runtime.
- docker-compose.yml: internal anouma-network (configurable), named volume
  for Postgres, app depends_on postgres healthy, no unnecessary published
  ports; docker-compose.override.yml.example documents joining an existing
  NPM network without ever touching NPM itself.
- Fix host-detection: isHost was Boolean(user), wrongly granting host
  privileges to logged-in customers; now checks user.collection === "users".
- Wire configurable STUN/TURN servers through to the WebRTC client
  (lib/meeting/iceServers.ts) so a TURN server can be added later via env
  vars only, no code changes.
- DEPLOYMENT.md, updated README.md and .env.example documenting the whole
  flow: NPM integration, env vars, WebRTC, updates, backups, rollback.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,36 +1,55 @@
+networks:
+  anouma-network:
+    name: ${DOCKER_NETWORK:-anouma-network}
+
+volumes:
+  pgdata:
+
 services:
   postgres:
     image: postgres:16-alpine
     restart: unless-stopped
+    networks:
+      - anouma-network
     environment:
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
-      POSTGRES_DB: anouma
-    ports:
-      - "5432:5432"
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
+      POSTGRES_DB: ${POSTGRES_DB:-anouma}
     volumes:
       - pgdata:/var/lib/postgresql/data
+    # Not published to the host by default — only reachable from other
+    # containers on anouma-network. Uncomment to reach it from the host too
+    # (e.g. with a GUI DB client) during development:
+    # ports:
+    #   - "127.0.0.1:5432:5432"
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
       interval: 5s
       timeout: 5s
-      retries: 10
+      retries: 20
 
-  # Optional: run the Next.js app in Docker too. For local development it's
-  # usually simpler to run `npm run dev` on the host against the Postgres
-  # container above (DATABASE_URI host: 127.0.0.1, as in .env.example).
-  # To run the whole stack in Docker instead, uncomment this service and set
-  # DATABASE_URI's host to `postgres` (the service name) in your .env file.
-  # app:
-  #   build: .
-  #   restart: unless-stopped
-  #   ports:
-  #     - "3000:3000"
-  #   env_file:
-  #     - .env
-  #   depends_on:
-  #     postgres:
-  #       condition: service_healthy
+  app:
+    build: .
+    restart: unless-stopped
+    networks:
+      - anouma-network
+    env_file:
+      - .env
+    # DATABASE_URI in .env must point at the "postgres" service name, e.g.
+    # postgresql://postgres:<password>@postgres:5432/anouma — setup.sh sets
+    # this up for you automatically.
+    ports:
+      - "127.0.0.1:${APP_PORT:-3000}:3000"
+    volumes:
+      - ./media:/app/media
+    depends_on:
+      postgres:
+        condition: service_healthy
+    # Container-level healthcheck is inherited from the Dockerfile's
+    # HEALTHCHECK instruction (GET /api/health, which itself checks Postgres
+    # connectivity) — nothing to duplicate here.
 
-volumes:
-  pgdata:
+  # Optional external network to a reverse proxy (e.g. Nginx Proxy Manager)
+  # is attached via docker-compose.override.yml, generated by setup.sh only
+  # when such a network is actually detected — see DEPLOYMENT.md. Nothing
+  # here assumes NPM (or any reverse proxy) exists.