Add Docker Desktop runtime setup

[lahuman]

Summary

Adds a secure Docker-based runtime configuration for running cokacremote on macOS with Docker Desktop.

• Adds a Node.js 22 Bookworm multi-stage Docker image
• Includes Git, curl, wget, OpenSSH client, Python 3, build tools, jq, and ripgrep
• Runs the service as the non-root node user
• Mounts the host workspace at /workspace
• Persists OAuth state in a named /data volume
• Binds the HTTP port to 127.0.0.1 only
• Does not mount the Docker socket, SSH keys, or host system directories
• Adds Docker Desktop setup and operation documentation

Files Changed

• Dockerfile
• docker-compose.yml
• .dockerignore
• DOCKER.md
• .env.example
• .gitignore
• workspace/.gitkeep

Validation

• docker compose config
• docker compose build
• docker compose up -d
• curl -f http://127.0.0.1:3000/health

Usage

cp .env.example .env
# Set MCP_AUTH_TOKEN to the output of: openssl rand -hex 32
docker compose up -d --build
docker compose logs -f cokacremote