feat(infra): каркас проекта — uv, ruff, mypy, pytest, Docker Compose

- pyproject: Python 3.12, зависимости ADR-009, ruff/mypy strict/pytest/coverage
- app/: точка входа-заглушка с graceful shutdown по SIGTERM
- Dockerfile: multi-stage, uv, non-root (uid 10001), git+ssh для коммитов (#9);
  apt по HTTPS — в некоторых сетях обычный HTTP к deb.debian.org заблокирован
- docker-compose: bot + postgres 16, healthcheck, лимиты памяти, ротация логов
- Makefile: install/lint/fmt/test/cov/up/down/logs/ps; .env.example

Refs #3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,23 @@
+# syntax=docker/dockerfile:1
+FROM python:3.12-slim AS build
+COPY --from=ghcr.io/astral-sh/uv:0.8 /uv /usr/local/bin/uv
+ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PROJECT_ENVIRONMENT=/opt/venv UV_PYTHON_DOWNLOADS=never
+WORKDIR /src
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
+COPY app ./app
+RUN uv sync --frozen --no-dev --no-editable
+
+FROM python:3.12-slim
+# git + ssh client: the bot commits to the uploads repo over SSH (#9)
+# apt over HTTPS: some networks block plain HTTP to deb.debian.org
+RUN sed -i 's|http://|https://|g' /etc/apt/sources.list.d/debian.sources \
+    && apt-get update && apt-get install -y --no-install-recommends git openssh-client \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --uid 10001 tgit
+ENV PATH="/opt/venv/bin:$PATH" PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
+COPY --from=build /opt/venv /opt/venv
+WORKDIR /srv/tgit
+COPY config ./config
+USER tgit
+CMD ["python", "-m", "app"]