feat: add production Docker deployment

server/Dockerfile

@@ -0,0 +1,40 @@
+FROM rust:1.85-bookworm AS builder
+
+WORKDIR /build
+
+COPY Cargo.toml Cargo.lock ./
+COPY migrations ./migrations
+COPY src ./src
+
+RUN cargo build --locked --release \
+    --bin teaching-feedback-api \
+    --bin migrate
+
+FROM debian:bookworm-slim AS runtime
+
+ARG DEBIAN_MIRROR=http://deb.debian.org
+
+RUN sed -i "s|http://deb.debian.org|${DEBIAN_MIRROR}|g" /etc/apt/sources.list.d/debian.sources \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --system --gid 10001 app \
+    && useradd --system --uid 10001 --gid app --home-dir /nonexistent --shell /usr/sbin/nologin app \
+    && install -d -o app -g app /data/audio
+
+COPY --from=builder /build/target/release/teaching-feedback-api /usr/local/bin/teaching-feedback-api
+COPY --from=builder /build/target/release/migrate /usr/local/bin/migrate
+
+ENV HOST=0.0.0.0 \
+    PORT=8080 \
+    AUDIO_STORAGE_DIR=/data/audio \
+    RUST_LOG=info
+
+USER app
+
+EXPOSE 8080
+
+HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=10 \
+    CMD ["curl", "-fsS", "http://127.0.0.1:8080/health"]
+
+CMD ["teaching-feedback-api"]