Deployment-Härtung + Podman-Container

- http.Server mit Timeouts (Slowloris) und Graceful Shutdown (SIGTERM)
- Adresse und DB-Pfad per Env (KVER_ADDR, KVER_DB)
- Security-Header global: nosniff, X-Frame-Options, Referrer-Policy, CSP
- Upload-Requests hart auf 17 MB gedeckelt (MaxBytesReader statt nur
  Multipart-Speichergrenze)
- Indizes für Feed-, Thread- und Vote-Queries
- middleware.RealIP für Logging/Rate-Limit hinter dem Reverse-Proxy
- Containerfile (Multi-Stage, Alpine, non-root) + Deploy-Doku in notes/

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Containerfile

@@ -0,0 +1,25 @@
+# Build-Stage: statisches Binary, CGO aus (modernc.org/sqlite ist pures Go).
+FROM docker.io/library/golang:1.26-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY *.go ./
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /kver .
+
+# Laufzeit-Stage: minimales Alpine, eigener unprivilegierter Nutzer.
+FROM docker.io/library/alpine:3.22
+RUN adduser -D -u 1000 kver
+WORKDIR /app
+COPY --from=build /kver /usr/local/bin/kver
+COPY web/ web/
+COPY static/ static/
+# data: SQLite-DB; static/media: Uploads. Beide als Volume persistieren.
+RUN mkdir -p data static/media && chown kver:kver data static/media
+USER kver
+ENV KVER_DB=/app/data/kver.db
+ENV KVER_ADDR=:8080
+EXPOSE 8080
+VOLUME ["/app/data", "/app/static/media"]
+HEALTHCHECK --interval=30s --timeout=3s \
+  CMD wget -qO /dev/null http://localhost:8080/entry/feed/0 || exit 1
+ENTRYPOINT ["/usr/local/bin/kver"]