chore: fix startup errors and harden project configuration

[errbchile]

What and why

The project had several issues preventing it from running and a number of security and configuration gaps. This PR addresses all of them before any feature work begins.

---

Security

• No secrets in source control — SECRET_KEY, DEBUG, ALLOWED_HOSTS, and STATICFILES_STORAGE are now read from environment variables via os.environ.get(). A hardcoded insecure key was the only option before.
• Unprivileged container user — The app no longer runs as root inside Docker. A dedicated myuser is created and applied with USER myuser.
• Secrets never enter the image layer — .env is excluded via .dockerignore, so docker build never copies it into any layer, even accidentally.
• OS-level CVE patches — Added apk upgrade to apply all available Alpine security patches at build time.

Bug fixes

• ModuleNotFoundError: No module named 'cgi' — python:latest was resolving to Python 3.14, which removed the cgi module that Django 4.0.2 depends on. Pinned to python:3.11-alpine3.22.
• DisallowedHost at / — ALLOWED_HOSTS defaulted to empty, blocking all requests. Now configurable via env with a safe local default.

Configuration & tooling

• .env.example — Documents every required environment variable with a SECRET_KEY generation command. No more hunting through the source to figure out what to set.
• .dockerignore — Reduces build context size and prevents local artifacts (db.sqlite3, __pycache__, staticfiles/) from being copied into the image.
• docker-compose.yml — Removed the deprecated version key, added env_file and restart: unless-stopped.
• STATICFILES_STORAGE override — Made overridable via env so the test suite doesn't require collectstatic to run.
• EXPOSE 8000 — Documents the application port for tooling and readers.
• .gitignore — Added .env, db.sqlite3, staticfiles/, virtualenv directories (env/, venv/) and Python caches.

Documentation

• README fully rewritten with Docker and Virtualenv setup options, test commands for both, admin credentials warning, and an environment variables reference table.

---

Testing

docker compose run --rm \
  -e STATICFILES_STORAGE=django.contrib.staticfiles.storage.StaticFilesStorage \
  testservice python manage.py test pms --verbosity=2

All tests pass. No application logic was changed in this PR.