feat: prepare ARR for controlled public deployment

Dockerfile

@@ -0,0 +1,28 @@
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1
+
+WORKDIR /app
+
+COPY requirements*.txt ./
+RUN python -m pip install --upgrade pip \
+    && python -m pip install \
+        --requirement requirements.txt \
+        --requirement requirements-arr-mcp.txt
+
+RUN groupadd --system arr \
+    && useradd --system --gid arr --create-home arr
+
+COPY . .
+
+RUN mkdir -p /app/runtime /app/outputs \
+    && chown -R arr:arr /app/runtime /app/outputs
+
+USER arr
+
+EXPOSE 8765 8890
+
+CMD ["python", "-m", "arr_web.run", "--host", "0.0.0.0", "--port", "8765"]