Write Dockerfile and verify containerized run

[mregen]

Multi-stage Dockerfile (SDK to build, aspnet/runtime to run), non-root user, config via env vars / mounted secrets rather than baked into the image.

[mregen]

Overlaps with the new Dockerfile issue #14 under the "Cloud multi-tenant service" milestone, which specifically targets deploying the invite-only beta (see docs/cloud-deployment.md). Leaving both open for now since #14 is a superset with a real deployment target attached, but close this one as a duplicate once that work actually starts.