Replace Singularity with Docker; add production deployment setup

- Remove Singularity.def; add Dockerfile (python:3.11-slim + ImageMagick,
  non-root user, installs gallery package with dev extras)
- Add .dockerignore to keep image lean
- Rewrite .gitlab-ci.yml: build→test→publish stages using Docker-in-Docker;
  push per-commit SHA tag and promote to :latest on main
- Add docker-compose.yml: gallery-generator + nginx services sharing a
  named volume; configurable GENERATE_INTERVAL env var
- Add deploy/nginx.conf: gzip, security headers, correct caching policy
  (immutable for assets, no-store for HTML)
- Add deploy/entrypoint.sh: runs gallery generate on startup then loops
  on GENERATE_INTERVAL; exits cleanly when interval is 0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,42 @@
+services:
+  generator:
+    build: .
+    image: etplot-gallery:latest
+    entrypoint: ["/app/deploy/entrypoint.sh"]
+    environment:
+      CONFIG_FILE: /config/config.yaml
+      # How often to regenerate the gallery (seconds). Set to 0 to run once and exit.
+      GENERATE_INTERVAL: "300"
+    volumes:
+      - ./config.yaml:/config/config.yaml:ro
+      # Mount your plot source directories here, matching the paths in config.yaml.
+      # Example:
+      # - /path/to/plots:/plots:ro
+      - gallery_output:/var/www/gallery
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "gallery", "--help"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
+  web:
+    image: nginx:1.27-alpine
+    ports:
+      - "${HTTP_PORT:-8080}:80"
+    volumes:
+      - ./deploy/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - gallery_output:/var/www/gallery:ro
+    depends_on:
+      - generator
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+volumes:
+  gallery_output: