feat(deploy): docker images, compose, roles SQL, local workspace

- core.Dockerfile: python:3.12-slim + node 22 copied (same bookworm glibc), non-root, tht+pi
- frontend.Dockerfile: vite build (env-driven base/assetsDir) + nginx-unprivileged
- compose.yaml (embedded, omics_network ext, zero host ports) + docker-compose.dev.yml (standalone)
- deploy/sql: thoth_dwh_reader (ro) + thoth_vector_rw (rw) roles
- deploy/thothii.env.example + harness/workspaces/local.yaml (direct DWH+vector, 5438)
- scripts/docker-smoke.sh; .dockerignore; gitignore deploy secrets
- verified: both images build, core health {ok}, config check validates local.yaml

docker/core-entrypoint.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Entrypoints logici del container thothii-core:
+#   server (default) | check | tht <args...> | preprocess <args...>
+# THT_CONFIG punta al workspace attivo (local.yaml nel deploy co-locato).
+set -euo pipefail
+export THT_CONFIG="${THT_CONFIG:-/app/harness/workspaces/local.yaml}"
+
+cmd="${1:-server}"
+case "$cmd" in
+  check)
+    # Diagnostica di wiring: validazione config/env + ping DWH (read-only).
+    shift
+    tht config check -c "$THT_CONFIG"
+    tht db ping -c "$THT_CONFIG" || echo "(db ping non verde: verificare .env/ruoli/VPN)"
+    ;;
+  tht)
+    shift
+    exec tht "$@"
+    ;;
+  preprocess)
+    shift
+    exec tht evidence index "$@"
+    ;;
+  *)
+    exec "$@"
+    ;;
+esac