Session 5: Dockerfile, config example, README rewrite

Multi-stage alpine Dockerfile builds with -tags goolm so libolm isn't
needed at runtime. Annotated config.example.yaml documents every field
and shows ${ENV_VAR} usage for secrets. README is rewritten for the Go
bot — Python-era web-portal docs are gone.

config.example.yaml

@@ -0,0 +1,42 @@
+# Bellhop config. Values like ${ENV_VAR} are expanded from the environment
+# at load time so secrets can stay out of this file.
+
+matrix:
+  homeserver: https://matrix.example.com
+  user_id: "@bellhop:example.com"
+  password: ${BELLHOP_MATRIX_PASSWORD}
+
+  # Optional. Defaults shown.
+  display_name: Bellhop
+  data_dir: ./data            # device.json + crypto.db live here
+  pickle_key: ${BELLHOP_PICKLE_KEY}  # encrypts the crypto store; pick something stable
+  command_prefix: "!"
+
+  # Rooms the bot will respond to commands in. Messages anywhere else are
+  # ignored. The bot auto-joins on invite, but joining alone does not grant
+  # command access — the room ID must appear here.
+  allowed_rooms:
+    - "!room-id-one:example.com"
+    - "!room-id-two:example.com"
+
+# Configure any subset. Omit a block to disable that command:
+# leaving out `radarr` makes `!movie` reply "Radarr is not configured".
+services:
+  radarr:
+    url: https://radarr.example.com
+    api_key: ${RADARR_API_KEY}
+    quality_profile_id: 1
+    root_folder: /movies
+
+  sonarr:
+    url: https://sonarr.example.com
+    api_key: ${SONARR_API_KEY}
+    quality_profile_id: 1
+    root_folder: /tv
+
+  lidarr:
+    url: https://lidarr.example.com
+    api_key: ${LIDARR_API_KEY}
+    quality_profile_id: 1
+    metadata_profile_id: 1   # required for Lidarr only
+    root_folder: /music