Add Dockerfile for Coolify deployment

Static non-root alpine image; tunneld must own host ports 443/80
directly since visitor TLS is SNI-routed and never proxy-terminated.

AGENTS.md

@@ -44,6 +44,12 @@ what we take vs. skip). Never vendor it into the build.
 
 ## Gotchas
 
+- **Deployment**: the multi-stage `Dockerfile` builds a static non-root
+  alpine image; verify `CGO_ENABLED=0 go build -trimpath -ldflags="-s -w"
+  ./cmd/tunneld` after changing build-affecting code (no Docker runtime on
+  the dev machine). Visitors must reach `tunneld` directly on 443/80 — never
+  behind a TLS-terminating proxy (Coolify's Traefik included).
+
 - **macOS system curl (LibreSSL) does not send SNI for `*.localhost` names**,
   so `curl https://api.<id>.localhost:8443/` gets closed (the relay requires
   SNI). Test with `openssl s_client -servername ...` or Homebrew curl.