Run the sync server as a plain container; stop cleanly on SIGTERM

Drop the Compose/Caddy example: production runs on Kubernetes, and locally
the container only needs a forwarded port and a volume. The README now gives
the `docker run` steps and what a Kubernetes deployment needs (one replica,
since it's a single SQLite file; a volume at /data; TLS at the ingress).

The server only shut down on Ctrl-C, so `docker stop` and pod termination,
which send SIGTERM, waited out the grace period and killed it. It now shuts
down gracefully on either.

Also ignore `.env`, which can hold the OIDC client secret.

README.md

@@ -159,18 +159,44 @@ signed out from another one.
 
 ## Running the sync server
 
-`mtgc-server` is a single binary with a SQLite database. Run it behind a
-reverse proxy that provides HTTPS (the Android app refuses plain HTTP outside
-debug builds). `crates/mtgc-server/deploy/` has a Docker Compose example with
-Caddy:
+`mtgc-server` is a single binary with a SQLite database, shipped as a
+container image. Inside the container it listens on port 8080 and keeps its
+database in `/data`; everything else is environment variables (below).
+
+To run it locally, build the image, then run it with the port forwarded to
+localhost and a named volume for the data:
 
 ```bash
-cd crates/mtgc-server/deploy
-cp .env.example .env               # set MTGC_PUBLIC_URL, sign-in options
-docker compose up -d
-docker compose exec mtgc-server mtgc-server user add yourname
+docker build -f crates/mtgc-server/Dockerfile -t mtgc-sync-server .
+
+docker run -d --name mtgc-sync-server \
+  -p 127.0.0.1:8080:8080 \
+  -v mtgc-sync-data:/data \
+  -e MTGC_PUBLIC_URL=http://localhost:8080 \
+  mtgc-sync-server
+
+docker exec -it mtgc-sync-server mtgc-server user add yourname   # prompts for a password
 ```
 
+Then sign in from the desktop app with `http://localhost:8080`. For more
+settings, copy `crates/mtgc-server/deploy/.env.example` to `.env` beside it
+(git ignores it) and pass `--env-file crates/mtgc-server/deploy/.env` instead
+of the `-e`. Podman takes the same commands.
+
+The container runs as UID 10001. A named volume, as above, picks up the right
+ownership by itself; if you bind-mount a host directory instead, `chown 10001`
+it first.
+
+In production, put it behind something that terminates HTTPS — the Android
+app refuses plain HTTP outside debug builds — and set `MTGC_PUBLIC_URL` to
+the `https://` address users reach it at. On Kubernetes that means a
+Deployment with **one replica** (it's a single SQLite file, so replicas can't
+share it) and a `Recreate` strategy, a PersistentVolumeClaim mounted at
+`/data`, a Service on port 8080, and an Ingress for TLS. `GET /healthz`
+answers `ok` for probes. Keep `MTGC_OIDC_CLIENT_SECRET` in a Secret. Run the
+account commands with `kubectl exec -it deploy/<name> -- mtgc-server user add
+<name>`.
+
 To build the image yourself and push it to your own registry:
 
 ```bash