Session 5: Dockerfile, config example, README rewrite

Multi-stage alpine Dockerfile builds with -tags goolm so libolm isn't
needed at runtime. Annotated config.example.yaml documents every field
and shows ${ENV_VAR} usage for secrets. README is rewritten for the Go
bot — Python-era web-portal docs are gone.

Dockerfile

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1
+
+FROM golang:1.25-alpine AS build
+RUN apk add --no-cache build-base
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+# goolm = pure-Go olm; sqlite needs cgo for the device/crypto stores.
+ENV CGO_ENABLED=1
+RUN go build -tags goolm -trimpath -ldflags="-s -w" -o /out/bellhop ./
+
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates tzdata
+RUN addgroup -S bellhop && adduser -S -G bellhop bellhop
+WORKDIR /app
+COPY --from=build /out/bellhop /usr/local/bin/bellhop
+USER bellhop
+VOLUME ["/app/data"]
+ENTRYPOINT ["/usr/local/bin/bellhop"]
+CMD ["-config", "/app/config.yaml"]