chore(docker): portable image and registry run template

Dockerfile: stop baking secrets into the image. Only NODE_ENV
remains; all runtime config (MONGO_URI, SMTP_*, token
secrets) comes from the environment so one image runs
anywhere. Install curl for container healthchecks. App
variable names untouched (singular JWT_EXPIRE as read by
models/User.js).

docker-compose.example.yml: rewrite as a prod run template
for git.linuxhg.com/games-database/games-api (IMAGE_TAG,
default latest) with restart, env_file .env, and a curl
/health healthcheck. Copy to docker-compose.yml next to
the server .env, then pull and up. Full variable list kept
commented out so values can live in the file instead of
.env if preferred.

docker-compose.example.yml

@@ -1,21 +1,39 @@
 ---
+# Prod run template. Copy to docker-compose.yml next to the server .env:
+#   cp docker-compose.example.yml docker-compose.yml
+# Then: docker compose pull && docker compose up -d
+#
+# Required keys in .env (singular JWT_EXPIRE, as read by models/User.js):
+#   ACCESS_TOKEN_SECRET, REFRESH_TOKEN_SECRET, JWT_EXPIRE,
+#   MONGO_URI, SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD,
+#   FROM_EMAIL, FROM_NAME, SECURE, NODE_ENV
+# Alternatively, comment out env_file above and uncomment the
+# environment list below to keep values directly in this file.
+    # environment:
+    #   - ACCESS_TOKEN_SECRET=
+    #   - REFRESH_TOKEN_SECRET=
+    #   - JWT_EXPIRE=
+    #   - MONGO_URI=
+    #   - SMTP_HOST=
+    #   - SMTP_PORT=
+    #   - SMTP_USER=
+    #   - SMTP_PASSWORD=
+    #   - FROM_EMAIL=
+    #   - FROM_NAME=
+    #   - SECURE=false
+    #   - NODE_ENV=
 services:
   games-api:
-    image: games-api
-    build: .
+    image: git.linuxhg.com/games-database/games-api:${IMAGE_TAG:-latest}
     container_name: games-api
-    environment:
-      - ACCESS_TOKEN_SECRET=
-      - REFRESH_TOKEN_SECRET=
-      - JWT_EXPIRE=
-      - MONGO_URI=
-      - SMTP_HOST=
-      - SMTP_PORT=
-      - SMTP_USER=
-      - SMTP_PASSWORD=
-      - FROM_EMAIL=
-      - FROM_NAME=
-      - SECURE=false
-      - NODE_ENV=
+    restart: unless-stopped
+    env_file:
+      - .env
     ports:
       - 5000:5000
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:5000/health || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s