feat(FN-1226): add production Docker workflow

- Add a root .dockerignore to reduce build context and exclude local runtime state
- Add a multi-stage Dockerfile that builds the workspace, runs as non-root, and includes health checks
- Document Docker build/run usage, env vars, persistence, and quick-start commands in README and docs/docker.md
- Add Docker configuration tests in packages/cli/src/docker.test.ts to validate required image and docs expectations

README.md

@@ -37,6 +37,16 @@ Fusion reuses your existing pi authentication.
 
 For Capacitor + PWA workflow, see [MOBILE.md](./MOBILE.md).
 
+## Docker
+
+Quick start:
+
+```bash
+docker build -t fusion . && docker run -p 4040:4040 -v $(pwd):/project -e ANTHROPIC_API_KEY=... fusion
+```
+
+For full Docker usage (env vars, persistence volumes, and runtime options), see [docs/docker.md](./docs/docker.md).
+
 ## Workflow
 
 ```mermaid