feat: add a Docker install path

Vite's dev server is the whole app here — it serves the client and runs every
API proxy as middleware — so one container running `npm run dev` covers it, and
HOST/PORT are already env-driven.

Three details are deliberate:

- The port publishes to 127.0.0.1. Docker's usual "4173:4173" binds every host
  interface, which would silently make the README's LAN warning the default for
  a server that brokers configured provider keys.
- The repo is bind-mounted, so keys saved from Provider Settings, .gev-cache
  and .gev-logs persist on the host exactly as they do under `npm run dev`.
  node_modules stays in the image so a host install cannot shadow the
  Linux-built native deps.
- The container runs as the host user, since everything it writes lands in
  that bind mount. Vite's dep optimizer still needs to write inside the image's
  node_modules, hence the two loosened directories.

Puppeteer's Chromium download is skipped: it is only needed by `npm run
test:track`, which the README points at the host.

Co-Authored-By: Claude Opus 5 <[email protected]>

README.md

@@ -145,6 +145,30 @@ See [docs/PERFORMANCE.md](docs/PERFORMANCE.md).
 **macOS shortcut:** `./scripts/dev-fresh.sh` clears the Vite cache and pulls any
 configured keys straight from the Keychain. It starts keyless too.
 
+### Path 3 — Docker
+
+No Node install needed; the container publishes the same dev server.
+
+```bash
+git clone https://github.com/bilawalsidhu/gods-eye-view.git
+cd gods-eye-view
+docker compose up
+```
+
+Open **`http://localhost:4173`** as above. The repo is bind-mounted, so `.env`,
+`.gev-cache` and `.gev-logs` live on the host and source edits still hot-reload.
+The container binds `0.0.0.0` *inside* the container, but the port is published
+to `127.0.0.1` only, so the default matches the native one: nobody else can
+reach your server. Widening that mapping puts you under
+[Sharing an instance](#-sharing-an-instance) — keys and all.
+
+`node_modules` deliberately stays inside the image, so it survives in an
+anonymous volume across restarts: after a `git pull` that changes dependencies,
+recreate it with `docker compose down -v && docker compose up --build`. The
+image also skips Puppeteer's Chromium download, which keeps it small but leaves
+`npm run test:track` to the host — `npm run build` and `npm test` run fine in
+the container.
+
 ### Then power it up — in the app, not in a file
 
 Keys are upgrades, not prerequisites. When you want one, click the **POWER UP**