Initial import of the public datacenter bingo site

The bingo card ran inside the asxpio container, dispatched by Host.
Give the public site its own repo, image and deploy so it can be
released and mirrored independently of asxp.io.

Editing stays in the asxp.io admin, which keeps owning the schema and
the photo pipeline; this app only reads the shared bingo tables and the
bingo/ photos, through a read-only DB role and MinIO user. Tests load a
snapshot of the asxpio-built schema (test/schema.sql).

Assisted-by: Claude:opus-5

Dockerfile

@@ -0,0 +1,32 @@
+FROM ruby:3.4-slim-bookworm
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    libpq-dev \
+ && rm -rf /var/lib/apt/lists/*
+
+RUN groupadd -g 11000 bingo \
+ && useradd -d /app -u 21000 -g 11000 -m -s /bin/bash bingo
+
+WORKDIR /app
+USER bingo
+
+ENV GEM_HOME=/app/bundle
+ENV PATH="${GEM_HOME}/bin:${PATH}"
+
+COPY --chown=bingo Gemfile Gemfile.lock* ./
+ENV BUNDLE_FROZEN=true
+RUN bundle install --without development:test
+
+COPY --chown=bingo . .
+
+ENV PUMA_PORT=3000
+ENV PUMA_THREADS="4:16"
+ENV RACK_ENV=production
+EXPOSE 3000
+
+# Slim image has no curl; ruby is right there.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD ruby -rnet/http -e 'port = ENV.fetch("PUMA_PORT", "3000"); exit(Net::HTTP.get_response(URI("http://127.0.0.1:#{port}/healthz")).code == "200" ? 0 : 1)'
+
+CMD ["sh", "-c", "exec puma -b tcp://0.0.0.0:${PUMA_PORT} -t ${PUMA_THREADS} --preload"]