chore(iios): production Dockerfile + migrate entrypoint + env/secrets contract

Adds a multi-stage Dockerfile for iios-service (build → pnpm deploy prune →
slim non-root runtime), a docker-entrypoint that runs `prisma migrate deploy`
then starts the server as PID 1, a .dockerignore, a fully-commented
.env.example config contract, and docs/DEPLOYMENT.md (topology, scaling,
release strategy, prod-readiness gaps). Moves prisma to dependencies so the
CLI ships in the prod bundle. Image builds, migrates, and serves /health 200.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,16 @@
+# Build context hygiene — keep the image small & builds reproducible.
+**/node_modules
+**/dist
+**/.turbo
+**/.next
+**/coverage
+.git
+.gitignore
+*.log
+**/*.tsbuildinfo
+.env
+.env.*
+!.env.example
+/tmp
+scratchpad
+docs/openapi.yaml