cnats: NATS-native chat with Leptos SSR and Kanidm SSO

Initial import plus deployment packaging: multi-stage Dockerfile
(cargo-leptos build -> debian-slim runtime), .dockerignore, and a
dev-only docker-compose (app + local NATS). Production deployment
lives in the infrastructure repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,21 @@
+# Copy to .env and fill in. `dotenvy` loads this at startup.
+
+# NATS server the chat server publishes/subscribes on.
+NATS_URL=nats://127.0.0.1:4222
+
+# Base URL of your Kanidm instance (no trailing slash).
+KANIDM_URL=https://idm.example.com
+
+# OAuth2 client registered in Kanidm (see README for the kanidm commands).
+OAUTH2_CLIENT_ID=cnats
+OAUTH2_CLIENT_SECRET=change-me
+
+# Where THIS app is reachable by browsers; the OIDC redirect is
+# ${PUBLIC_URL}/auth/callback and must match the Kanidm client config.
+PUBLIC_URL=http://localhost:3000
+
+# Set to true when serving over HTTPS so session cookies are Secure-only.
+COOKIE_SECURE=false
+
+# Optional: log filter
+# RUST_LOG=info,cnats=debug