Add Dockerfile, .dockerignore, and Gitea CI for image build/push

Made-with: Cursor

README.md

@@ -33,6 +33,19 @@ Then open the docs at:
 
 If other machines still can’t connect, check your macOS firewall and any router/network rules.
 
+## Docker
+
+Build and run (pass env via file or `-e`; the app reads `.env` only if you mount it):
+
+```bash
+docker build -t notebook-tools:local .
+docker run --rm -p 8080:8080 --env-file .env notebook-tools:local
+```
+
+`LLAMA_BASE_URL` / `PAPERLESS_BASE_URL` must be reachable **from inside the container** (use `host.docker.internal` on Docker Desktop, or your LAN IP, not `127.0.0.1` for services on the host).
+
+CI: on push to `main`, [.gitea/workflows/build-docker.yml](.gitea/workflows/build-docker.yml) builds and pushes using the same secrets pattern as your other Gitea repos (`DOCKER_REGISTRY`, `DOCKER_USERNAME`, `DOCKER_PASSWORD`). For Docker Hub, set `DOCKER_REGISTRY` to `docker.io` (or leave per your runner docs).
+
 ## Example `.env`
 
 ```bash