feat(docker): pull-based prod stack (docker-compose.prod.yml + Registry-Images)

Produktivsystem baut nicht mehr selbst, sondern zieht die drei fertigen Images
(novasonic-frontend/-backend/-scrobble) aus der Gitea-Registry. Das bestehende
docker-compose.yml bleibt der Build-auf-dem-Host-Weg. Dazu .dockerignore fuers
Frontend-Image (android/, backend/, .git raus) und README/CLAUDE.md aktualisiert.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -0,0 +1,65 @@
+# NovaSonic — PRODUKTIV: zieht die fertigen Images aus der Registry, baut nichts.
+# Auf dem Server nur .env danebenlegen (siehe .env.example) und:
+#
+#   docker compose -f docker-compose.prod.yml pull
+#   docker compose -f docker-compose.prod.yml up -d
+#
+# Die Images kommen von der Dev-Maschine: `npm run push-images`
+# (baut die drei Dockerfiles und pusht nach ${REGISTRY}). Zum Bauen auf dem Host
+# stattdessen das normale docker-compose.yml nehmen.
+services:
+
+  # ── Frontend (nginx serving the built PWA) ───────────────────────────────────
+  novasonic-frontend:
+    image: ${REGISTRY}/novasonic-frontend:${TAG:-latest}
+    container_name: novasonic-frontend
+    restart: unless-stopped
+    ports:
+      - "8080:80"          # route this port through your reverse proxy
+    environment:
+      - NAVIDROME_URL=${NAVIDROME_URL}   # pre-filled on the setup screen
+      - BACKEND_URL=${BACKEND_URL}
+      - SCROBBLE_URL=${SCROBBLE_URL}
+
+  # ── Backend (yt-dlp download server) ─────────────────────────────────────────
+  novasonic-backend:
+    image: ${REGISTRY}/novasonic-backend:${TAG:-latest}
+    container_name: novasonic-backend
+    restart: unless-stopped
+    volumes:
+      - ${MUSIC_PATH}:${MUSIC_PATH}      # exact path from .env, no remapping
+      - novasonic-data:/data             # writable data dir for overrides, state, etc.
+    ports:
+      - "3700:3700"
+    environment:
+      - PORT=3700
+      - MUSIC_PATH=${MUSIC_PATH}
+      - DATA_PATH=/data
+      - AUDIO_FMT=${AUDIO_FMT:-mp3}
+      - AUDIO_QUALITY=${AUDIO_QUALITY:-0}
+      - MAX_PARALLEL=${MAX_PARALLEL:-2}
+      - DOWNLOAD_BACKEND=${DOWNLOAD_BACKEND:-ytdlp}
+      - TICKETMASTER_API_KEY=${TICKETMASTER_API_KEY}
+      # Android APK download button — backend proxies the fixed Gitea release ("apk-latest").
+      - GITEA_URL=${GITEA_URL:-}
+      - GITEA_REPO=${GITEA_REPO:-}
+      - GITEA_TOKEN=${GITEA_TOKEN:-}
+      - GITEA_APK_TAG=${GITEA_APK_TAG:-apk-latest}
+
+  # ── Scrobble service (isolated timestamped play-log → stats + Wrapped) ───────
+  novasonic-scrobble:
+    image: ${REGISTRY}/novasonic-scrobble:${TAG:-latest}
+    container_name: novasonic-scrobble
+    restart: unless-stopped
+    volumes:
+      - novasonic-scrobble-data:/data    # own DB volume, isolated from downloads
+    ports:
+      - "3710:3710"
+    environment:
+      - PORT=3710
+      - DATA_PATH=/data
+      - NAVIDROME_URL=${NAVIDROME_URL}   # for ping.view auth verification
+
+volumes:
+  novasonic-data:
+  novasonic-scrobble-data: