Add deployment artifacts and rift config (Phase 13)

Dockerfiles for API server and web UI (multi-stage, alpine:3.21,
non-root mcr user). systemd units with security hardening. Idempotent
install script. Rift-specific config with MCIAS service token, TLS
paths, and Docker compose with loopback port bindings for mc-proxy
fronting (28443/29443/28080).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/systemd/mcr-backup.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=MCR Database Backup
+
+[Service]
+Type=oneshot
+User=mcr
+Group=mcr
+ExecStart=/usr/local/bin/mcrsrv snapshot --config /srv/mcr/mcr.toml
+ExecStartPost=/usr/bin/find /srv/mcr/backups -name 'mcr-*.db' -mtime +30 -delete
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+ReadWritePaths=/srv/mcr

deploy/systemd/mcr-backup.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=MCR Daily Database Backup
+
+[Timer]
+OnCalendar=*-*-* 02:00:00 UTC
+RandomizedDelaySec=300
+Persistent=true
+
+[Install]
+WantedBy=timers.target

deploy/systemd/mcr-web.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=MCR Container Registry Web UI
+After=mcr.service
+Wants=mcr.service
+
+[Service]
+Type=simple
+User=mcr
+Group=mcr
+ExecStart=/usr/local/bin/mcr-web --config /srv/mcr/mcr.toml
+Restart=on-failure
+RestartSec=5
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+ReadOnlyPaths=/srv/mcr
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/mcr.service

@@ -0,0 +1,34 @@
+[Unit]
+Description=MCR Container Registry
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=mcr
+Group=mcr
+ExecStart=/usr/local/bin/mcrsrv server --config /srv/mcr/mcr.toml
+Restart=on-failure
+RestartSec=5
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+ReadWritePaths=/srv/mcr
+
+# Allow binding to privileged ports if needed
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target