Run the sync server as a plain container; stop cleanly on SIGTERM

Drop the Compose/Caddy example: production runs on Kubernetes, and locally
the container only needs a forwarded port and a volume. The README now gives
the `docker run` steps and what a Kubernetes deployment needs (one replica,
since it's a single SQLite file; a volume at /data; TLS at the ingress).

The server only shut down on Ctrl-C, so `docker stop` and pod termination,
which send SIGTERM, waited out the grace period and killed it. It now shuts
down gracefully on either.

Also ignore `.env`, which can hold the OIDC client secret.

.gitignore

@@ -28,3 +28,6 @@ Thumbs.db
 .idea/
 *.swp
 *.swo
+
+# Server settings, which may hold an OIDC client secret. Only the example is tracked.
+.env