build: add Dockerfile to compile and run Naut from source

Multi-stage build that compiles nautd, nautctl, and the webui plugin
(plus the external engine submodules) at image build time, so a rebuild
is the only thing that changes the running version. The runtime stage
ships only the binaries, the two submodule shared libs, the static
torrent-ui assets, and the runtime shared libraries, running as a
non-root user.

Defaults bind the web UI on 0.0.0.0:8080 with data under /data (state +
webui.db) and downloads under /downloads, both as volumes; all tunables
are overridable via -e. A .dockerignore keeps build output, VCS data,
and local downloads/databases out of the context.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,31 @@
+# Build output (recompiled inside the image)
+build/
+**/build/
+
+# VCS metadata — source is copied, submodule working trees are already populated
+.git/
+**/.git/
+.gitmodules.bak
+
+# Local data that must never end up in the image
+Downloads/
+downloads/
+*.mkv
+*.mp4
+*.torrent
+*.db
+*.db-wal
+*.db-shm
+state/
+uploads/
+
+# Logs / scratch
+*.log
+claude.*
+list.log
+dump.log
+
+# Editor / OS noise
+.vscode/
+.idea/
+.DS_Store