Issue 17: StartOS 0.4.0 packaging

- Dockerfile: multi-stage build (Node frontend + Python backend)
- StartOS manifest, interfaces, backups, version graph
- start.sh: auto-generates session secret, creates first approver on boot
- Backend serves built frontend as SPA in production
- Single data volume for SQLite DB, platform backups cover it

deploy/Dockerfile

@@ -0,0 +1,40 @@
+# --- Frontend build stage ---
+FROM node:20-slim AS frontend-build
+
+WORKDIR /build/frontend
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --include=dev
+COPY frontend/ ./
+RUN npx vite build
+
+# --- Backend stage ---
+FROM python:3.11-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Install Python deps
+COPY backend/pyproject.toml ./
+COPY backend/ten31portal/ ./ten31portal/
+COPY backend/alembic/ ./alembic/
+COPY backend/alembic.ini ./
+RUN pip install --no-cache-dir .
+
+# Copy built frontend
+COPY --from=frontend-build /build/frontend/dist ./static/
+
+# Startup script
+COPY deploy/start.sh ./start.sh
+RUN chmod +x ./start.sh
+
+# Data volume mount point
+RUN mkdir -p /data
+
+ENV TEN31_DB_PATH=/data/portal.db
+ENV TEN31_SESSION_SECRET=change-me
+
+EXPOSE 8000
+
+CMD ["./start.sh"]