build: tighten Docker setup for local-stack parity

- Dockerfile: npm ci (uses package-lock for reproducible installs)
- CMD now: migrate → seed (idempotent) → start. Gated by SEED_ON_BOOT.
- docker-compose: name: helix, healthcheck on /, OAuth env defaults to empty
  so `docker compose up` works without a .env (public pages render; sign-in
  fails until OAuth is configured).
- README: explicit "Run it locally — two ways" section. Docker first
  (production-like), native Node second. Documents port-conflict workaround
  and Gitea OAuth setup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -9,8 +9,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
       python3 make g++ \
     && rm -rf /var/lib/apt/lists/*
 
-COPY package.json package-lock.json* ./
-RUN npm install --include=dev
+COPY package.json package-lock.json ./
+RUN npm ci --include=dev
 
 COPY . .
 RUN npm run build
@@ -39,5 +39,6 @@ COPY --from=build --chown=node:node /app/scripts ./scripts
 USER node
 EXPOSE 3000
 
-# Run migrations then start the SvelteKit Node server.
-CMD ["sh", "-c", "node scripts/migrate.js && node build"]
+# Run migrations + seed (idempotent INSERT OR IGNORE) then start the server.
+# Set SEED_ON_BOOT=false in production once you've added real content.
+CMD ["sh", "-c", "node scripts/migrate.js && { [ \"$SEED_ON_BOOT\" = \"false\" ] || node scripts/seed.js; } && node build"]