feat: add Docker support and inbound webhooks (Tier 2)

- Dockerfile: multi-stage build (node:22-alpine), better-sqlite3 native deps handled
- .dockerignore + docker-compose.yml for deployment
- FLYNN_DATA_DIR env var support in daemon, CLI, and TUI
- WebhookHandler: ChannelAdapter for HTTP POST /webhooks/:name
- Per-webhook HMAC auth, template rendering ({{body}}, {{json.field}})
- Config schema: automation.webhooks array with name/secret/message/output
- Gateway routes webhook requests before static files (bypasses gateway auth)
- 23 new tests for webhook functionality, 874 total tests passing

docker-compose.yml

@@ -0,0 +1,34 @@
+services:
+  flynn:
+    build: .
+    container_name: flynn
+    restart: unless-stopped
+    ports:
+      - "18800:18800"
+    volumes:
+      # Persistent data (sessions DB, memory store)
+      - flynn-data:/data
+      # Mount your config file
+      - ./config/default.yaml:/config/config.yaml:ro
+    environment:
+      # Required: at least one model provider API key
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
+      # Optional: additional provider keys
+      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
+      - GOOGLE_API_KEY=${GOOGLE_API_KEY:-}
+      # Optional: Telegram integration
+      - FLYNN_TELEGRAM_TOKEN=${FLYNN_TELEGRAM_TOKEN:-}
+      # Optional: Discord integration
+      - DISCORD_BOT_TOKEN=${DISCORD_BOT_TOKEN:-}
+      # Optional: Gateway auth token
+      - FLYNN_SERVER_TOKEN=${FLYNN_SERVER_TOKEN:-}
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:18800/"]
+      interval: 30s
+      timeout: 5s
+      start_period: 15s
+      retries: 3
+
+volumes:
+  flynn-data: