feat(deploy): docker images, compose, roles SQL, local workspace

- core.Dockerfile: python:3.12-slim + node 22 copied (same bookworm glibc), non-root, tht+pi
- frontend.Dockerfile: vite build (env-driven base/assetsDir) + nginx-unprivileged
- compose.yaml (embedded, omics_network ext, zero host ports) + docker-compose.dev.yml (standalone)
- deploy/sql: thoth_dwh_reader (ro) + thoth_vector_rw (rw) roles
- deploy/thothii.env.example + harness/workspaces/local.yaml (direct DWH+vector, 5438)
- scripts/docker-smoke.sh; .dockerignore; gitignore deploy secrets
- verified: both images build, core health {ok}, config check validates local.yaml

docker/nginx.conf

@@ -0,0 +1,36 @@
+# nginx per thothii-frontend: serve la SPA (modalità standalone) e reverse-proxy /api -> core.
+# In modalità embedded il portale proxya /datamart-builder/assets/ qui (solo asset statici);
+# il blocco /api non è usato in embedded (il portale hita core direttamente).
+server {
+    listen 8080;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # SPA fallback (standalone)
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Reverse proxy verso il backend (stessa rete Docker)
+    location /api/ {
+        proxy_pass http://core:8787/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # SSE: niente buffering, timeout lunghi
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+        chunked_transfer_encoding on;
+    }
+
+    # manifest.json servito (lo legge il template tag Django in embedded)
+    location = /manifest.json {
+        default_type application/json;
+    }
+}