Add Dockerfile for coulomb-social delivery-lane packaging

Non-root gunicorn image with /healthz check; railiance-apps values still open.

Dockerfile

@@ -0,0 +1,47 @@
+# syntax=docker/dockerfile:1.7
+# coulomb.social — commit-SHA images for the business delivery lane.
+#
+#   docker build -t forgejo.coulomb.social/coulomb/coulomb-social:<git-sha> .
+
+FROM python:3.12-slim-bookworm AS deps
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential libpq-dev curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/astral-sh/uv:0.5.11 /uv /usr/local/bin/uv
+
+WORKDIR /app
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
+
+FROM python:3.12-slim-bookworm
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PATH="/app/.venv/bin:$PATH" \
+    DJANGO_SETTINGS_MODULE=coulomb_social.settings.prod
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libpq5 ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --uid 10001 appuser
+
+WORKDIR /app
+COPY --from=deps /app/.venv /app/.venv
+COPY manage.py pyproject.toml ./
+COPY coulomb_social ./coulomb_social
+
+RUN chown -R appuser:appuser /app
+USER appuser
+
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/healthz')" || exit 1
+
+CMD ["gunicorn", "coulomb_social.wsgi:application", "--bind", "0.0.0.0:8000", "--workers", "2"]