Add Docker setup and fix proxy config for containerized deployment

- Program.cs: remove UseHsts/UseHttpsRedirection (NPM terminates TLS,
  would loop behind the proxy, plan.md AE-4), add UseForwardedHeaders
  with emptied known networks/proxies. Uses KnownIPNetworks (net10).
- Dockerfile: SDK build stage, chiseled aspnet runtime on port 8080.
- .dockerignore: keep build output, git and docs out of the image.
- compose.yaml: temporary test setup (builds from source, exposes
  5000:8080) for the first run on Unraid without NPM or registry.
- .gitignore: exclude .idea/ (Rider project files).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,22 @@
+# syntax=docker/dockerfile:1
+
+# --- Build-Stufe: SDK-Image kompiliert und published die App ---
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+# Zuerst nur die csproj kopieren und restoren, damit der NuGet-Restore-Layer
+# gecacht bleibt, solange sich die Abhaengigkeiten nicht aendern.
+COPY Elternbeirat.Web/Elternbeirat.Web.csproj Elternbeirat.Web/
+RUN dotnet restore Elternbeirat.Web/Elternbeirat.Web.csproj
+
+# Dann der restliche Quellcode.
+COPY . .
+RUN dotnet publish Elternbeirat.Web/Elternbeirat.Web.csproj -c Release -o /app
+
+# --- Runtime-Stufe: schlankes chiseled-Image, laeuft als non-root (UID 1654),
+# hoert auf Port 8080, enthaelt keine Shell (kein HEALTHCHECK mit curl/sh). ---
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled AS runtime
+WORKDIR /app
+COPY --from=build /app .
+EXPOSE 8080
+ENTRYPOINT ["dotnet", "Elternbeirat.Web.dll"]