cnats: NATS-native chat with Leptos SSR and Kanidm SSO

Initial import plus deployment packaging: multi-stage Dockerfile
(cargo-leptos build -> debian-slim runtime), .dockerignore, and a
dev-only docker-compose (app + local NATS). Production deployment
lives in the infrastructure repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,25 @@
+# Multi-stage build for the cnats Leptos (SSR + hydrate) app.
+# Built by the infrastructure repo via `docker_image.cnats` (or manually:
+# docker build -t cnats .)
+
+FROM rust:1-bookworm AS builder
+RUN rustup target add wasm32-unknown-unknown \
+    && cargo install cargo-leptos --locked
+WORKDIR /app
+COPY . .
+RUN cargo leptos build --release
+
+FROM debian:bookworm-slim
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY --from=builder /app/target/release/cnats /usr/local/bin/cnats
+COPY --from=builder /app/target/site /app/site
+
+ENV LEPTOS_SITE_ROOT=/app/site \
+    LEPTOS_SITE_ADDR=0.0.0.0:3000 \
+    RUST_LOG=info
+
+EXPOSE 3000
+CMD ["cnats"]