Containerize the Matrix intake bot as a managed service (restart: unless-stopped)

Turn the bot from a bare nohup process (silently dies on a Spark reboot) into a docker-compose service. Dockerfile bundles backend/matrix_intake + the stdlib backend/ingest Spark client it reuses; .env is mounted read-only at runtime, never baked. The existing repo-root .dockerignore (shared with the s9pk build) already keeps data/ and .env out of context. Also adds a handoff doc for wiring a spark-control dashboard card in a later session.

docker-compose.yml

@@ -0,0 +1,22 @@
+# Runs the Matrix intake bot as a managed container on the Spark (spark-32d0, user `modelo`).
+#
+# `restart: unless-stopped` is the actual durability fix — the bot now survives a Spark reboot
+# (it was a bare nohup process before, which silently died on reboot). `network_mode: host` so
+# it can reach Matrix (clearnet TLS), the CRM API (box LAN), and Spark Control (local Qwen).
+# The container name is fixed so a future spark-control dashboard card can find it by
+# `docker inspect matrix-intake` (see docs/handoffs/add-intake-bot-to-spark-control.md).
+#
+# Deploy / update on the Spark:  docker compose up -d --build
+# Logs:                          docker logs -f matrix-intake
+# Stop:                          docker compose down   (or: docker stop matrix-intake)
+services:
+  intake:
+    build:
+      context: .
+      dockerfile: backend/matrix_intake/Dockerfile
+    image: matrix-intake-bot
+    container_name: matrix-intake
+    network_mode: host
+    restart: unless-stopped
+    volumes:
+      - ./.env:/app/.env:ro