Archify Sync server, Dockerfile and Helm chart

Rust server (axum, yrs, sqlx/PostgreSQL): live shared models over the y-websocket protocol, versions, browser sign-in with PKCE, invites, single sign-on through OIDC, metrics. Docker image on distroless, compose file, and a Helm chart with one pod, optional bundled PostgreSQL and secrets from existing Secrets.

Dockerfile

@@ -0,0 +1,26 @@
+# Archify Sync server: one static-ish binary on distroless, running as non-root.
+#   docker build -t archify-sync .
+
+FROM rust:1.99-slim-trixie AS build
+WORKDIR /src
+COPY Cargo.toml Cargo.lock ./
+COPY .cargo .cargo
+COPY crates crates
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/src/target \
+    cargo build --release --locked -p archify-sync-server \
+ && cp target/release/archify-sync-server /archify-sync-server
+
+FROM gcr.io/distroless/cc-debian13:nonroot
+LABEL org.opencontainers.image.title="Archify Sync" \
+      org.opencontainers.image.description="Live, shared Archify models" \
+      org.opencontainers.image.source="https://gitea.lego-cloud.eu/vscode-extensions/archify-vscode-ext-sync" \
+      org.opencontainers.image.licenses="MIT"
+COPY --from=build /archify-sync-server /usr/local/bin/archify-sync-server
+ENV ARCHIFY_SYNC_LISTEN=0.0.0.0:8080 \
+    ARCHIFY_SYNC_LOG_JSON=true
+EXPOSE 8080
+USER nonroot
+HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=3 \
+  CMD ["/usr/local/bin/archify-sync-server", "healthcheck"]
+ENTRYPOINT ["/usr/local/bin/archify-sync-server"]