feat(infra): containerize BFF + compose-up smoke (refs #29)

Add a multi-stage Dockerfile for the BFF (.NET 10 sdk -> aspnet runtime,
curl for the healthcheck) and infra/docker-compose.yml running it with a
/health healthcheck. `docker compose up --wait` gates on the container
reporting healthy, which is the compose-up smoke test. Document the path
in the README.

Verified: image builds; `docker compose up -d --build --wait` reports the
container Healthy; host curl http://localhost:8080/health -> 200 Healthy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/bff/Dockerfile

@@ -0,0 +1,30 @@
+# Multi-stage build for the placeholder BFF (.NET 10).
+# Build context is services/bff (see infra/docker-compose.yml).
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+# Restore first (cached unless the csproj changes).
+COPY Bff.Api/Bff.Api.csproj Bff.Api/
+RUN dotnet restore Bff.Api/Bff.Api.csproj
+
+# Then build + publish.
+COPY Bff.Api/ Bff.Api/
+RUN dotnet publish Bff.Api/Bff.Api.csproj -c Release -o /app/publish /p:UseAppHost=false
+
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
+WORKDIR /app
+
+# curl is used by the container HEALTHCHECK / compose healthcheck.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /app/publish .
+
+ENV ASPNETCORE_URLS=http://+:8080
+EXPOSE 8080
+
+HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -fsS http://localhost:8080/health || exit 1
+
+ENTRYPOINT ["dotnet", "Bff.Api.dll"]