Add Docker Compose installation and Docker Hub publication

[decryptus]

Why

Installing CertLord currently requires separately provisioning Vault, Redis and Auton. Provide a documented single-host installation with protected APIs and persistent data.

Changes

• Non-root Python 3.12 application image with the qualified Certbot/Auton clients and Textual.
• Compose stack, explicit Vault bootstrap/unseal, scoped AppRole, random credentials, optional restricted HTTP-01 frontend and persistent volumes.
• Deployment job fails until the operator configures their actual destination; no false deployment success.
• Native AMD64/ARM64 Compose smoke checks before optional Docker Hub publication.
• User installation guide and separate contributor publication instructions.

Validation

Sphinx warnings-as-errors build and script syntax checks passed locally. Docker runtime validation runs in GitHub Actions because the local execution environment has no Docker engine. Existing full lifecycle and package gates remain enabled.

No source release tag is moved; CertLord runtime remains 1.0.0. Docker Hub publication requires DOCKERHUB_TOKEN in this repository.