feat(delivery): phase 12 — the container, and the defect only a proxy could find

PLAN.md §13 phase 12, the last one. Four decisions of record, D54–D57, taking the
count to fifty-seven; recorded in §6, "How phase 12 delivered it".

A two-stage Dockerfile, a pull-only docker-compose.yml carrying both bind mounts,
.env.example, the workflow that publishes and deploys, CONTRIBUTING.md, the
community-health files this was the only repository of the ten to lack, and
DEPLOY.md.

D54 — a merge deploys, amending D6. build-image.yml pushes
runicgateway-site:latest and :sha-<7>, then rolls the container over on the
`rgcom` runner out of /opt/runicgateway.com, and waits for the container's own
healthcheck rather than for `up -d` to return.

D55 — the site runs on its own host behind a generic reverse proxy, so DEPLOY.md
states the four requirements rather than one worked example, and the container
binds 127.0.0.1 so the safe configuration is the default.

D56 — @astrojs/node derives the request protocol from req.socket.encrypted and
never reads x-forwarded-proto, so behind a TLS-terminating proxy the browser sends
Origin: https://… while the container computes http://… and Astro's CSRF check
compares them for equality. Every beta signup, from every visitor, was answered
403. serve.mjs now normalises both forwarded headers, unconditionally — the image
should deploy and work. Two assertions in test/headers.test.mjs hold both halves.

D57 — DEPLOY.md rather than a README section; SECURITY.md and CODE_OF_CONDUCT.md
are pointers to the org's copies rather than copies, because a copy would hard-code
the contact address D13 confines to brand.json.

Verified: npm run verify green (eleven checks, 36 unit tests, 7 served tests,
astro check 0 errors). The image was built and run with both mounts — a mounted
brand reached 51 files and all 50 search pages, /brand/* fell back per file, a
proxy-shaped signup reached the store, and the export CLI wrote both Play files to
the host mount. docker compose config caught a YAML trap in the healthcheck: a
block sequence reads the `: ` in `r.ok ? 0 : 1` as a mapping.

Co-Authored-By: Claude <noreply@anthropic.com>

.env.example

@@ -0,0 +1,61 @@
+# runicgateway.com — production environment.
+#
+# Copy to `.env` beside docker-compose.yml on the host and fill in the two
+# secrets. Everything else has a working default; this file exists so the
+# defaults are visible rather than discovered.
+#
+#   cp .env.example .env
+#
+# Nothing here is a credential for another service. The site talks to no API,
+# sends no mail (D7) and has no database server — the only state it keeps is a
+# SQLite file on the ./data mount.
+
+# ---------------------------------------------------------------------------------------
+# Deployment
+# ---------------------------------------------------------------------------------------
+
+# Which published build runs. `latest` follows main; pin `sha-<7>` for a
+# reproducible deploy or to roll back — every merge publishes both tags.
+IMAGE_TAG=latest
+
+# Host port the container is published on, bound to 127.0.0.1 (see the note in
+# docker-compose.yml if your reverse proxy cannot reach the host's loopback).
+SITE_HOST_PORT=4321
+
+# ---------------------------------------------------------------------------------------
+# The closed-beta signup (PLAN.md §8)
+# ---------------------------------------------------------------------------------------
+#
+# THE TWO BELOW ARE THE ONLY VALUES THAT REALLY WANT SETTING. Both default to a
+# random value generated per process, which is safe but forgetful: every restart
+# invalidates every rate-limit window and every rendered form. That is the right
+# default — a hard-coded salt shipped in a public repository would make every
+# deployment's ip_hash values identical and therefore reversible by anyone who
+# can read it — but it is not what you want on a host that restarts.
+#
+# Generate both once, keep them, and do not rotate them casually: changing the
+# salt orphans the rate-limit history of everyone already counted.
+#
+#   openssl rand -hex 32
+
+# Salts the ip_hash column. The raw IP address is never stored — /privacy says
+# so, and this is the mechanism that makes it true while still allowing a
+# per-connection limit.
+BETA_IP_SALT=
+
+# Signs the hidden form token, so a script has to fetch the page before it can
+# post. Rotating this only invalidates forms currently open in a browser.
+BETA_FORM_KEY=
+
+# Rows, across all time, above which the form closes and says so on the page.
+BETA_TOTAL_CAP=500
+
+# What one connection may do, in a rolling hour and a rolling day.
+BETA_PER_HOUR=3
+BETA_PER_DAY=24
+
+# Seconds between the page rendering and the form posting. Below the minimum is
+# treated as a script; above the maximum the form is stale and re-rendered.
+# Twelve hours is the default maximum.
+BETA_MIN_SECONDS=2
+BETA_MAX_SECONDS=43200