chore: Update Dockerfile, compose, and self-hosting guide for hosted Authsome

[manojbajaj95]

Summary

Refresh the Docker deployment artifacts and documentation so hosted Authsome production setup is accurate, complete, and easy to follow.

Current state

The repo ships a multi-stage Dockerfile, docker-compose.yml, and docs/guides/self-hosting.md, but several gaps remain for a polished hosted deployment story:

• Dockerfile (Dockerfile): Builds UI via pnpm, packages a Python wheel with [postgres,redis] extras, runs as non-root authsome user on port 7998. Health check hits /health.
• docker-compose.yml: Wires authsome + postgres:16-alpine + redis:7-alpine. Requires AUTHSOME_POSTGRES_PASSWORD, AUTHSOME_MASTER_KEY, and AUTHSOME_UI_SESSION_KEY from the host. Sets AUTHSOME_DO_NOT_TRACK=1 by default. Registry image line is commented out (ghcr.io/agentrhq/authsome:latest).
• docs/guides/self-hosting.md: Covers quick start, env vars, secret resolution, backup/restore, and upgrades — but may be out of sync with recent server/runtime changes.
• CI (.github/workflows/docker.yml): Builds on version tags only; push: false — no published image to GHCR yet.

Problems / gaps

• Compose quick start in README.md omits required secrets (AUTHSOME_POSTGRES_PASSWORD, AUTHSOME_MASTER_KEY, AUTHSOME_UI_SESSION_KEY) that docker-compose.yml hard-requires.
• No published container image workflow; self-hosters must build locally.
• _FILE secret variants are documented in the guide but not wired in the default compose file.
• Hosted deployment may need updates for recent Postgres/Redis-backed runtime (ServerSettings, AUTHSOME_ENV=prod requiring both URLs).
• TLS termination, reverse-proxy (AUTHSOME_BASE_URL), and production hardening notes could be expanded.

Proposed work

• Align docker-compose.yml with current server boot requirements and sensible production defaults.
• Update Dockerfile if build/runtime steps have drifted (UI embed path, optional extras, health check).
• Bring docs/guides/self-hosting.md and README self-hosting section in sync with compose reality.
• Consider publishing images to GHCR on release tags (extend .github/workflows/docker.yml).
• Document first-run / init flow for hosted mode (account registration, identity claim).

Relevant files

• Dockerfile
• docker-compose.yml
• docs/guides/self-hosting.md
• README.md (Self-hosting section)
• .github/workflows/docker.yml
• src/authsome/server/config.py, src/authsome/server/settings.py

Acceptance criteria

• A new operator can follow the guide end-to-end without hitting undocumented required env vars.
• docker compose up works with documented secrets and passes /health.
• README and guide agree on prerequisites and first-run steps.