Baseline: wave 1A server complete, wave 1B Android scaffold + design system green

assembleDebug, testDebugUnitTest, and recordPaparazziDebug all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bThmkmyUUdqQpy3MXFFe5

server/deploy/Dockerfile

@@ -0,0 +1,30 @@
+# Bookshelf PocketBase server — container image.
+#
+# The pocketbase binary is already vendored into ./server (this repo does not
+# gitignore it out of the image build context — see server/.gitignore, which
+# only excludes it from *git*). If you'd rather fetch it fresh, replace the
+# COPY below with a curl of the official release for your architecture from
+# https://github.com/pocketbase/pocketbase/releases (match the version
+# already pinned in server/pocketbase --version, currently v0.40.2).
+
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates curl \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /pb
+
+COPY pocketbase /pb/pocketbase
+COPY pb_migrations /pb/pb_migrations
+COPY pb_hooks /pb/pb_hooks
+RUN chmod +x /pb/pocketbase
+
+# pb_data is a volume — see docker-compose.yml. Do not bake data into the
+# image; it must survive container recreation.
+VOLUME /pb/pb_data
+
+EXPOSE 8090
+
+ENTRYPOINT ["/pb/pocketbase"]
+CMD ["serve", "--http=0.0.0.0:8090", "--dir=/pb/pb_data", "--migrationsDir=/pb/pb_migrations", "--hooksDir=/pb/pb_hooks"]