feat: add Hetzner-hosted todo application stack

Implement the server-rendered Go todo application with PostgreSQL persistence, Tailwind styling, health checks, and test coverage.

Provision production and staging infrastructure with OpenTofu, including private networking, static IPs, Object Storage backups, and load balancing.

Configure Rocky Linux hosts with Ansible, rootless Podman, PostgreSQL, WAL-G backup automation, staging restores, and generated inventory.

app/Dockerfile

@@ -0,0 +1,27 @@
+# syntax=docker/dockerfile:1.7
+FROM alpine:3.21 AS css
+ARG TARGETARCH
+ARG TAILWIND_VERSION=v3.4.17
+WORKDIR /src
+RUN apk add --no-cache ca-certificates curl \
+    && case "$TARGETARCH" in amd64) tw_arch=x64 ;; arm64) tw_arch=arm64 ;; *) exit 1 ;; esac \
+    && curl -fsSL -o /usr/local/bin/tailwindcss "https://github.com/tailwindlabs/tailwindcss/releases/download/${TAILWIND_VERSION}/tailwindcss-linux-${tw_arch}" \
+    && chmod +x /usr/local/bin/tailwindcss
+COPY tailwind.config.js ./
+COPY web/input.css web/input.css
+COPY web/templates web/templates
+RUN mkdir -p web/static && tailwindcss -c tailwind.config.js -i web/input.css -o web/static/app.css --minify
+
+FROM golang:1.22-bookworm AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+COPY --from=css /src/web/static/app.css web/static/app.css
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /todo ./cmd/server
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /todo /todo
+EXPOSE 8080
+USER nonroot:nonroot
+ENTRYPOINT ["/todo"]