Add Docker Compose production stack (php-apache, mariadb, node/pm2)

Single-command deploy: docker compose up -d --build brings up the LEMP
stack plus the Node realtime/scheduler service. app/config.php and DB
secrets are generated from .env at container start, never baked into
the image or committed.

docker-compose.yml

@@ -0,0 +1,55 @@
+services:
+  db:
+    image: mariadb:11
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
+      MYSQL_DATABASE: wms
+    volumes:
+      - db_data:/var/lib/mysql
+      - ./docker/mariadb/init-wms2.sql:/docker-entrypoint-initdb.d/init-wms2.sql:ro
+    networks: [wms]
+
+  php:
+    build:
+      context: .
+      dockerfile: docker/php/Dockerfile
+    restart: unless-stopped
+    depends_on: [db]
+    environment:
+      DB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
+      PUBLIC_HOST: ${PUBLIC_HOST}
+      EMIT_SECRET: ${EMIT_SECRET}
+      SMTP_USERNAME: ${SMTP_USERNAME}
+      SMTP_PASSWORD: ${SMTP_PASSWORD}
+    volumes:
+      - .:/var/www/html/wms-app
+    ports:
+      - "${HTTP_PORT:-80}:80"
+    networks: [wms]
+
+  node:
+    build:
+      context: .
+      dockerfile: docker/node/Dockerfile
+    restart: unless-stopped
+    depends_on: [php]
+    environment:
+      PORT: 3000
+      EMIT_SECRET: ${EMIT_SECRET}
+      PHP_BASE_URL: http://php
+      PHP_WEBROOT: /wms-app/app
+      ALLOWED_ORIGIN: http://${PUBLIC_HOST}
+    volumes:
+      - ./nodejs:/app
+      - node_modules:/app/node_modules
+    ports:
+      - "3000:3000"
+    networks: [wms]
+
+volumes:
+  db_data:
+  node_modules:
+
+networks:
+  wms: