feat(deploy): docker images, compose, roles SQL, local workspace

- core.Dockerfile: python:3.12-slim + node 22 copied (same bookworm glibc), non-root, tht+pi
- frontend.Dockerfile: vite build (env-driven base/assetsDir) + nginx-unprivileged
- compose.yaml (embedded, omics_network ext, zero host ports) + docker-compose.dev.yml (standalone)
- deploy/sql: thoth_dwh_reader (ro) + thoth_vector_rw (rw) roles
- deploy/thothii.env.example + harness/workspaces/local.yaml (direct DWH+vector, 5438)
- scripts/docker-smoke.sh; .dockerignore; gitignore deploy secrets
- verified: both images build, core health {ok}, config check validates local.yaml

scripts/docker-smoke.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Smoke test del deploy standalone ThothII (core + frontend).
+# Usa docker-compose.dev.yml (rete propria, porte host). Non tocca il portale.
+# Prereq: deploy/thothii.env popolato + ruoli DB creati + pi-config + settings.json.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+DC="docker compose -f docker-compose.dev.yml"
+WS="/app/harness/workspaces/local.yaml"
+
+echo "== ThothII standalone smoke =="
+$DC config --quiet
+
+echo "== Build =="
+$DC build
+
+echo "== Up (wait health) =="
+$DC up -d --wait
+
+echo "== Core health =="
+curl -fsS http://localhost:8787/health && echo
+
+echo "== Frontend serve =="
+curl -fsSI http://localhost:8090/ | head -1
+
+echo "== Wiring check (config + DWH ping; -c è per-command) =="
+$DC exec -T core tht config check -c "$WS" || \
+  echo "(config check non verde: verificare .env/ruoli DB)"
+$DC exec -T core tht db ping -c "$WS" || \
+  echo "(db ping non verde: verificare ruolo thoth_dwh_reader + rete)"
+
+echo "== Down =="
+$DC down
+
+echo "OK: smoke standalone passato."