Run the server in Docker for the new lab server

[rcb1409]

Why

eln_server is moving from the old droplet (a systemd service on a venv, gunicorn serving TLS itself) to the new lab server, where each app runs in Docker behind the shared Caddy edge proxy. The lab's address stays the same, https://eln.ddomlab.org:5000: Caddy will send /pth/... to the PTH container and everything else to this one (separate PR in ddomlab/lab-edge).

What's added

File	Purpose
Dockerfile	Python 3.11 on Debian 12, the same as the old server. Adds Pango + DejaVu fonts (label PDFs), libXrender/libXext (RDKit images), tzdata. Runs as uid 1000, 1 gunicorn worker (as before, ~120–160 MB), --timeout 600 to match the timer client, access log to stdout. Healthcheck on /ping.
constraints.txt	Exact package versions the offline tests and the local eLabFTW 5.6.12 run passed with, so a rebuild months from now installs the same code.
deploy/compose.yaml	Builds from the checkout. Mounts config.yaml (writable, because the settings page saves to it) and secrets.yaml (read-only) from the repo root. Joins lab-net, publishes only 127.0.0.1:5001 for the timers on the same host. cap_drop: ALL, no-new-privileges, 512 MB memory cap. Won't start if either file is missing, instead of Docker silently creating empty folders.
.dockerignore	Keeps secrets, config, tests and .git out of the image.
.github/workflows/docker-image.yml	On PRs and pushes to main: build, run the offline tests inside the image, smoke-test /ping, / and a label PDF (asserts the text renders in DejaVu). Nothing is published.
client/install.sh	Optional ELN_SERVER_URL=... to point the timers at the server at install time.
README.md	Docker deploy steps.

Behavior change

Container time is America/New_York, like the eLabFTW container. The old server ran in UTC, so bottles opened after 8 PM Eastern were stamped with the next day's "Opened" date.

Tested locally (Docker Desktop, arm64)

• Image builds. 72 offline tests pass inside it.
• docker compose up with this compose file: healthy, runs as eln, 512 MB limit, all capabilities dropped. /ping answers on 127.0.0.1:5001 and as eln-server:5000 from another container on lab-net.
• Label PDF renders its text in embedded DejaVu Sans Mono, the same font the old server uses. No fontconfig or gunicorn errors in the logs.
• The settings page can write config.yaml through the mount.
• With secrets.yaml missing, compose refuses to start ("bind source path does not exist").
• I ran the workflow's steps locally from the YAML file. GitHub will run them on amd64 on this PR.

🤖 Generated with Claude Code