feat: docker, readme, jev goal gate

Dockerfile/compose written but never built or run on this machine (no Docker). smoke.sh now works in both modes and fails loudly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/smoke.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# The one command that proves the app answers. Two modes, same checks:
+#   bash scripts/smoke.sh                      # app already running (BASE=http://localhost:3000)
+#   bash scripts/smoke.sh --docker             # via docker compose (Docker is not installed on this machine)
+set -uo pipefail
+BASE=${BASE:-http://localhost:3000}
+fail=0
+check() { # check <label> <expected> <actual>
+  if [ "$2" = "$3" ]; then echo "ok   $1"; else echo "FAIL $1: expected [$2] got [$3]"; fail=1; fi
+}
+
+if [ "${1:-}" = "--docker" ]; then
+  docker compose up --build -d
+  trap 'docker compose down -v' EXIT
+  for _ in $(seq 1 40); do curl -fsS "$BASE/api/healthz" >/dev/null 2>&1 && break; sleep 2; done
+fi
+
+check "healthz" '{"ok":true}' "$(curl -fsS "$BASE/api/healthz" 2>/dev/null)"
+check "login page" "200" "$(curl -fsS -o /dev/null -w '%{http_code}' "$BASE/login")"
+check "signup page" "200" "$(curl -fsS -o /dev/null -w '%{http_code}' "$BASE/signup")"
+check "signed-out /app redirects" "307" "$(curl -s -o /dev/null -w '%{http_code}' "$BASE/app")"
+check "analyze needs a session" "401" "$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'content-type: application/json' -d '{}' "$BASE/api/analyze")"
+[ $fail -eq 0 ] && echo "smoke ok" || { echo "smoke FAILED"; exit 1; }