chore: scaffold pnpm workspace, container, deploy docs

Two-app pnpm workspace for the gashboard (mining dashboard) project:
@gashboard/api (Express 5 + TS) and @gashboard/web (Vue 3 + Vite + TS).
Shared tsconfig.base.json. Multi-stage Dockerfile (node:22.12-alpine,
non-root, healthchecked) and docker-compose.yml ready to deploy as a
Portainer Stack on Umbrel — joins umbrel_main_network so it can reach
the Datum container directly. .env.example documents every var; README
covers the Portainer deploy flow and the security posture.

Note: Dockerfile has a TODO marker to SHA256-pin the base image before
shipping to production.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,47 @@
+version: "3.9"
+
+# gashboard — deploy as a Portainer Stack on the same Umbrel host that runs Datum.
+# IMPORTANT: set `networks.datum.name` below to the actual docker network the
+# Datum app uses (find it on the Umbrel with `docker network ls | grep datum`).
+
+services:
+  gashboard:
+    # Portainer "Stacks → Repository" will build this from the gashboard git repo.
+    # If you want to pull a pre-built image instead, comment out `build:` and
+    # set `image:` to your registry tag.
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: gashboard:0.1.0
+    container_name: gashboard
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      PORT: "8080"
+      LOG_LEVEL: "${LOG_LEVEL:-info}"
+      CORS_ORIGIN: "${CORS_ORIGIN:-}"
+      DATUM_URL: "${DATUM_URL:-http://datum_datum_1:21000}"
+      DATUM_ADMIN_USER: "${DATUM_ADMIN_USER:-admin}"
+      DATUM_ADMIN_PASSWORD: "${DATUM_ADMIN_PASSWORD?must be set}"
+      DATUM_POLL_INTERVAL_MS: "${DATUM_POLL_INTERVAL_MS:-5000}"
+      NOSTR_ALLOWED_NPUBS: "${NOSTR_ALLOWED_NPUBS?must be set}"
+      JWT_SECRET: "${JWT_SECRET?must be set}"
+      JWT_TTL_SECONDS: "${JWT_TTL_SECONDS:-86400}"
+    ports:
+      - "8420:8080"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    networks:
+      - umbrel_main
+      - default
+
+networks:
+  umbrel_main:
+    external: true
+    # Datum container on this Umbrel sits on `umbrel_main_network` (10.21.0.0/16).
+    # Confirmed via `docker network ls` on the Umbrel host.
+    name: umbrel_main_network