Add single-container Docker appliance and multi-arch publishing

[magiccodingman]

What changed

• adds a single TruthGate appliance image containing .NET 10, TruthGate, Kubo, and the matching ipfs CLI
• adds one production Compose definition with persistent TruthGate state, Kubo repository metadata, and Kubo blocks split by default
• adds a development override that reuses the appliance layout with the SDK image, source bind mount, persistent NuGet caches, and dotnet watch
• adds shared process supervision for Kubo and TruthGate, graceful shutdown, readiness waits, health checks, and automatic Kubo repository migration
• keeps the Kubo RPC API on 127.0.0.1:5001 and the raw Kubo gateway on 127.0.0.1:9010; TruthGate remains the authenticated HTTP control boundary
• temporarily publishes Kubo's TCP and UDP swarm port directly, while documenting the planned architecture where TruthGate will own swarm transport exposure too

Opinionated Kubo server setup

TruthGate now configures Kubo as a contributing public server by default rather than a desktop-style local node:

• initializes new repositories with Kubo's server profile
• applies the server profile once to existing repositories, tracked in persistent state
• forces Routing.Type=dhtserver
• preserves Kubo's listener array while ensuring IPv4/IPv6 TCP, QUIC-v1, and WebTransport listeners exist
• enables hole punching and the relay client
• enables content providing with strategy all
• enables the persistent DHT sweep provider and resume support with a 22-hour interval
• keeps the RPC API and raw gateway loopback-only even when advanced overrides are supplied
• detects public IPv4/IPv6 addresses and manages TCP, QUIC-v1, and WebTransport entries in Addresses.AppendAnnounce
• removes stale TruthGate-managed announce entries without deleting operator-managed entries

Storage and GC

• defaults Datastore.StorageMax to auto
• auto mode uses 90% of the filesystem containing the mounted Kubo blockstore
• falls back to 200GB only if capacity detection fails
• accepts fixed Kubo sizes such as 750GB, 2TB, or 5TiB
• recalculates automatic sizing on every container start, so expanding a VPS disk requires only a restart rather than an image rebuild
• starts Kubo with --enable-gc by default and manages Datastore.StorageGCWatermark

Configuration model

TruthGate creates persistent files on first boot:

• /data/truthgate/config/kubo-settings.json for normal managed settings and future UI control
• /data/truthgate/config/kubo-overrides.json for arbitrary advanced Kubo config paths

Individual Compose/environment settings override the managed settings file. Advanced overrides can tune additional Kubo options, but cannot expose Addresses.API or Addresses.Gateway.

A new diagnostic command reports the effective configuration and live node state:

docker exec truthgate truthgate-kubo-status

Persistent contract

• /data/truthgate
• /data/ipfs/repo
• /data/ipfs/repo/blocks (separate host mount)

The Kubo identity, keystore/IPNS keys, repository configuration, blocks, TruthGate configuration, database, certificates, secrets, managed Kubo settings, and application state survive container and image replacement.

Security and first-run behavior

• managed services run as an unprivileged user
• ASP.NET data-protection keys and rate-limiter data use persistent locations
• fresh Docker installs generate a bootstrap administrator password rather than using a known default
• Kubo's administrator-level RPC API is never published directly

Validation completed

• production Compose definition validates
• production + development Compose merge validates
• all container shell scripts pass syntax validation
• production and development images build on native AMD64
• production and development images build on native ARM64
• the appliance boots and reaches Docker healthy on both architectures
• runtime tests verify dhtserver, hole punching, relay client, provider strategy, sweep/resume, auto storage sizing, GC watermark, modern swarm listeners, and loopback API/gateway bindings
• truthgate-kubo-status runs successfully on both architectures
• container replacement preserves Kubo peer identity, bootstrap credential, and persistent managed Kubo settings
• local two-boot mock testing verifies fixed storage, environment overrides, advanced overrides, protected RPC bindings, and stale managed announce-address cleanup
• existing TLS lifecycle tests pass
• build and runtime diagnostic logs are retained as CI artifacts

The GHCR publishing job remains intentionally skipped for pull requests. After merge to master, the workflow publishes one multi-platform master tag plus a commit-SHA tag; version tags additionally produce semantic-version tags.

Scope intentionally excluded

• the future libp2p/swarm proxy layer inside TruthGate
• live Kubo restart/control from the TruthGate UI (the persistent settings contract is now ready for it)
• backup implementation or an external host helper
• JuiceFS, FUSE, network mount management, or mount-health monitoring