Replace Singularity with Docker; add production deployment setup

- Remove Singularity.def; add Dockerfile (python:3.11-slim + ImageMagick,
  non-root user, installs gallery package with dev extras)
- Add .dockerignore to keep image lean
- Rewrite .gitlab-ci.yml: build→test→publish stages using Docker-in-Docker;
  push per-commit SHA tag and promote to :latest on main
- Add docker-compose.yml: gallery-generator + nginx services sharing a
  named volume; configurable GENERATE_INTERVAL env var
- Add deploy/nginx.conf: gzip, security headers, correct caching policy
  (immutable for assets, no-store for HTML)
- Add deploy/entrypoint.sh: runs gallery generate on startup then loops
  on GENERATE_INTERVAL; exits cleanly when interval is 0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy/entrypoint.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+CONFIG_FILE="${CONFIG_FILE:-/config/config.yaml}"
+GENERATE_INTERVAL="${GENERATE_INTERVAL:-300}"  # seconds between regenerations; 0 = run once and exit
+
+if [ ! -f "$CONFIG_FILE" ]; then
+    echo "ERROR: config file not found at $CONFIG_FILE" >&2
+    exit 1
+fi
+
+run_generate() {
+    echo "[$(date -u +%FT%TZ)] Running gallery generate..."
+    gallery --config "$CONFIG_FILE" generate --verbose
+}
+
+run_generate
+
+if [ "$GENERATE_INTERVAL" -eq 0 ]; then
+    exit 0
+fi
+
+while true; do
+    sleep "$GENERATE_INTERVAL"
+    run_generate
+done

deploy/nginx.conf

@@ -0,0 +1,40 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /var/www/gallery;
+    index index.html;
+
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Gzip
+    gzip on;
+    gzip_vary on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+    gzip_min_length 1024;
+
+    # Static assets: cache aggressively
+    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
+        expires 7d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # HTML: no cache so regenerated galleries are picked up immediately
+    location ~* \.html$ {
+        expires -1;
+        add_header Cache-Control "no-store";
+    }
+
+    location / {
+        try_files $uri $uri/ $uri/index.html =404;
+    }
+
+    # Deny access to hidden files
+    location ~ /\. {
+        deny all;
+    }
+}