feat: add packaging, deployment, error pages, and project docs

Phase 7 — Polish:
- Error page template with styled 404/403/500 pages
- Error rendering helper on Renderer

Phase 8 — Packaging & Deployment:
- Containerfile: multi-stage build, non-root user, health check,
  OCI labels with build date and git revision
- Makefile: build, test, cross-compile, deb, rpm, container,
  tarballs, checksums targets
- nfpm.yaml: .deb and .rpm package config
- systemd service: hardened with NoNewPrivileges, ProtectSystem,
  ProtectHome, PrivateTmp, RestrictSUIDSGID
- Default environment file with commented examples
- postinstall/preremove scripts (shellcheck validated)
- compose.yaml: example Podman/Docker Compose
- Caddyfile.example: subdomain, subpath, and remote proxy configs
- CHANGELOG.md for release notes
- CLAUDE.md with architecture, conventions, and quick reference

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Caddyfile.example

@@ -0,0 +1,32 @@
+# Example Caddy configurations for Favoritter.
+# Copy the relevant section to your Caddyfile.
+
+# --- Option 1: Subdomain deployment ---
+# Set FAVORITTER_EXTERNAL_URL=https://faves.example.com
+# Set FAVORITTER_TRUSTED_PROXIES to Caddy's IP
+
+faves.example.com {
+    reverse_proxy localhost:8080
+}
+
+# --- Option 2: Subpath deployment ---
+# Set FAVORITTER_BASE_PATH=/faves
+# Set FAVORITTER_EXTERNAL_URL=https://example.com/faves
+# Set FAVORITTER_TRUSTED_PROXIES to Caddy's IP
+
+# example.com {
+#     handle_path /faves/* {
+#         reverse_proxy localhost:8080
+#     }
+#     # Redirect /faves to /faves/
+#     redir /faves /faves/ permanent
+# }
+
+# --- Option 3: Remote proxy (WireGuard/Tailscale) ---
+# Caddy runs on a different machine than Favoritter.
+# Set FAVORITTER_TRUSTED_PROXIES=100.64.0.0/10 (Tailscale)
+# or the specific WireGuard IP of the Caddy machine.
+
+# faves.example.com {
+#     reverse_proxy 100.64.1.2:8080
+# }