feat(docker): deploy su VPS via traefik con cerbero-mcp interno

Dockerfile multi-stage (python:3.13-slim + uv) e docker-compose con due
servizi che condividono l'immagine:

- multi-swarm-paper: runner long-running scripts/run_paper_trading.py
- multi-swarm-dashboard: Streamlit su https://swarm.${DOMAIN_NAME}

Cerbero raggiunto via rete docker interna (http://cerbero-mcp:9000)
saltando il giro pubblico traefik+TLS. Persistenza via bind mount su
data/, series/, state/ (runs.db con WAL), strategies/ in read-only.

.env.example aggiornato con DOMAIN_NAME, SWARM_DASHBOARD_PORT (porta
interna parametrizzabile) e i PAPER_* per override del command.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,52 @@
+# syntax=docker/dockerfile:1.7
+#
+# Multi-Swarm Coevolutive — immagine unica usata da due servizi:
+#   * paper-trading runner (scripts/run_paper_trading.py)
+#   * Streamlit dashboard (src/multi_swarm/dashboard/streamlit_app.py)
+#
+# Builder stage: risolve uv.lock con `uv sync --frozen --no-dev` e produce
+# un venv in /app/.venv. Runtime stage: copia solo /app + scripts/ e gira
+# come utente non-root. data/, series/, strategies/, state/ sono bind
+# mount dal compose, quindi non finiscono nell'immagine.
+
+FROM python:3.13-slim AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential curl \
+    && rm -rf /var/lib/apt/lists/*
+RUN pip install --no-cache-dir "uv>=0.5,<0.9"
+WORKDIR /app
+COPY pyproject.toml uv.lock README.md ./
+COPY src ./src
+RUN uv sync --frozen --no-dev
+
+
+FROM python:3.13-slim AS runtime
+LABEL org.opencontainers.image.title="multi-swarm" \
+      org.opencontainers.image.version="0.1.0" \
+      org.opencontainers.image.source="https://git.tielogic.xyz/Adriano/Multi_Swarm_Coevolutive"
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY --from=builder /app /app
+COPY scripts ./scripts
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONPATH=/app/src
+
+RUN useradd -m -u 1000 app \
+    && mkdir -p /app/data /app/series /app/state /app/strategies \
+    && chown -R app:app /app
+USER app
+
+# Healthcheck di default: import del package — i servizi reali lo
+# sovrascrivono nel compose (streamlit /_stcore/health).
+HEALTHCHECK --interval=60s --timeout=5s --retries=3 --start-period=10s \
+    CMD python -c "import multi_swarm" || exit 1
+
+# Nessun CMD di default: il compose specifica entrypoint/command
+# per ognuno dei due servizi.