feat: Docker image auto-publish to GHCR + Watchtower support

fix: lock container PORT=8080, revert HEALTHCHECK to hardcoded port

fix: expose OAuth callback port 1455 in Docker Compose

fix: Docker container auto-detect host proxy via host.docker.internal

fix: Docker build installs curl, keeps tsx, optimizes layers

fix: Docker build uses host network for proxy access

fix: use BUILD_PROXY arg to avoid BuildKit proxy conflict

fix: Docker build supports proxy via .env configuration

refactor: fingerprint alignment, auto-maintenance, Docker deployment