Add dark mode palettes + Woodpecker CI pipeline

- Add 2 dark palettes (Nuit, Ocean) to DisplaySettings with full SVG
  theme tokens — all hardcoded SVG colors (grids, legends, text fills,
  pills, dot strokes, drag handles) replaced with reactive bindings
- Update scoped CSS to use var(--color-*) and var(--svg-*) throughout
- Add Woodpecker CI pipeline (.woodpecker.yml): build → docker push → deploy
- Add multi-stage Dockerfiles for backend (Python) and frontend (Nuxt)
- Add production docker-compose with Traefik labels + dev override
- Remove old single-stage Dockerfiles and root docker-compose.yml
- Update Makefile with docker-dev target
- Exclude data files (pdf, xls, ipynb) from git

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker/docker-compose.yml

@@ -0,0 +1,43 @@
+name: sejeteralo
+
+services:
+  backend:
+    build:
+      context: ../
+      dockerfile: docker/backend.Dockerfile
+      target: production
+    environment:
+      DATABASE_URL: sqlite+aiosqlite:///./sejeteralo.db
+      SECRET_KEY: ${SECRET_KEY}
+      DEBUG: "false"
+      CORS_ORIGINS: '["https://${DOMAIN:-sejeteralo.org}"]'
+    volumes:
+      - backend-data:/app
+    restart: always
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.sejeteralo-api.rule=Host(`${DOMAIN:-sejeteralo.org}`) && PathPrefix(`/api`)"
+      - "traefik.http.routers.sejeteralo-api.entrypoints=websecure"
+      - "traefik.http.routers.sejeteralo-api.tls.certresolver=letsencrypt"
+      - "traefik.http.services.sejeteralo-api.loadbalancer.server.port=8000"
+
+  frontend:
+    build:
+      context: ../
+      dockerfile: docker/frontend.Dockerfile
+      target: production
+    environment:
+      NODE_ENV: production
+      NUXT_PUBLIC_API_BASE: http://backend:8000/api/v1
+    depends_on:
+      - backend
+    restart: always
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.sejeteralo.rule=Host(`${DOMAIN:-sejeteralo.org}`)"
+      - "traefik.http.routers.sejeteralo.entrypoints=websecure"
+      - "traefik.http.routers.sejeteralo.tls.certresolver=letsencrypt"
+      - "traefik.http.services.sejeteralo.loadbalancer.server.port=3000"
+
+volumes:
+  backend-data: