feat(docker): add Coolify/deploy image for iris server

[shivros]

Purpose

Make iris deployable: multi-stage Dockerfile (linux/arm64 target — Hetzner CAX fleet), env-driven entrypoint, .dockerignore.

What's in the image

• Builder: rust:1.89-slim + libssl-dev/pkg-config (lettre → native-tls chain). Cargo cache mounts for fast rebuilds.
• Runtime: debian:bookworm-slim + libssl3/ca-certificates, non-root iris user, /data volume (attachments via IRIS_ATTACHMENT_DIR, audit via IRIS_AUDIT_DIR).
• Entrypoint materializes iris.toml from IRIS_ENABLED_PROVIDERS (comma list: mock/telegram/email/sms). All secrets env-backed via iris's { env = ... } SecretValue — nothing baked into the image. A full config mounted at /etc/iris/iris.mounted.toml overrides generation.
• Server: iris serve --addr 0.0.0.0:9876, /health endpoint.

Environment tested

• Built on builder-01 (linux/arm64) during deploy verification.
• Runtime target: platform-01 via Coolify.

Verification

• Image builds on builder-01
• Container boots with mock provider, /health responds
• docker inspect shows Architecture: arm64

[shivros]

Auto-Merge Gate — Approval Rationale

Confidence: 0.91 — MERGE (squash)

Goal recovery: No linked Linear ticket; goal recovered from the PR body — make iris deployable via multi-stage Docker image (arm64/Hetzner fleet), env-driven entrypoint, .dockerignore, no secrets baked into the image.

Semantic verification performed (beyond CI):

• Config wiring audited against source: IRIS_CONFIG env resolution confirmed in load_default_config() (crates/iris-providers/src/config.rs), SecretValue { env = "..." } untagged enum matches, all six email credential keys match required() calls in email.rs, sms ssh_host/phone_number match sms.rs, mock ignores credentials at registry dispatch. IRIS_ATTACHMENT_DIR/IRIS_AUDIT_DIR env handling confirmed in iris-cli/src/commands.rs.
• Branch was behind main (strict branch protection): updated via merge of origin/main (creed-adoption commit, zero file overlap with Docker files) — pushed as a270632, all 6 CI checks re-ran green on it.
• Image built locally from this branch: docker build → success.
• Container booted with default mock provider: entrypoint log Enabling provider: mock, generated /etc/iris/iris.toml verified valid, non-root iris user, GET /health → {"status":"ok"}.

Checks observed: Test, Format Check, Clippy, Secret Scan, Dependency Audit, Creed context drift — all SUCCESS on head a270632.

Scope limits: 3 files, +129/−0, all new files — no Rust source touched, secrets env-only via { env = ... } SecretValue, mounted-config override path preserved.

Residual note: arm64 base resolution not exercised locally (x86_64 host); accepted on the author's builder-01 deploy-verification record. Build logic is arch-agnostic.

Gate policy: standing gate per repo policy (AGENTS.md: CI green + confidence ≥ 0.80). No manual-review markers found.