Baseline md2vk: docs, audit log, docker 8420, openspec, deploy

Dockerfile

@@ -0,0 +1,32 @@
+FROM python:3.12-slim AS builder
+
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+FROM python:3.12-slim
+
+WORKDIR /app
+
+# Только бинарники и зависимости — без сборщика
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
+
+COPY app/ app/
+COPY .env.example .env
+
+# Read-only rootfs — только /data для БД и /logs для аудита
+RUN mkdir -p /data /logs && chmod 755 /data /logs
+
+# Не root
+RUN useradd -m -u 1000 md2vk && chown -R md2vk:md2vk /app /data /logs
+USER md2vk
+
+EXPOSE 8420
+
+# Ключ шифрования — через Docker secret /run/secrets/token_encryption_key
+ENV TOKEN_ENCRYPTION_KEY_FILE=/run/secrets/token_encryption_key
+ENV DATABASE_URL=sqlite+aiosqlite:////data/md2vk.db
+ENV AUDIT_LOG_DIR=/logs
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8420"]