add suite: all-in-one Docker image with noc + Gitea

- Switch to rustls (drop OpenSSL dependency) for musl static build
- Add deploy/ with Dockerfile and entrypoint (Gitea auto-setup + admin token)
- Add Makefile targets: build-musl, docker
- Add doc/suite.md: design doc for human-AI collaboration interfaces

Makefile

@@ -1,16 +1,33 @@
 REPO := $(shell pwd)
 HERA := heradev
 HERA_DIR := noc
+IMAGE := noc-suite
 
-.PHONY: build test deploy deploy-hera
+.PHONY: build build-musl test deploy deploy-hera docker
 
 build:
 	cargo build --release
 
+build-musl:
+	cargo build --release --target x86_64-unknown-linux-musl
+	strip target/x86_64-unknown-linux-musl/release/noc
+
 test:
 	cargo clippy -- -D warnings
 	cargo test -- --nocapture
 
+# ── docker ──────────────────────────────────────────────────────────
+
+docker: build-musl
+	cp target/x86_64-unknown-linux-musl/release/noc deploy/noc
+	cp -r tools deploy/tools
+	cp config.example.yaml deploy/config.example.yaml
+	sudo docker build -t $(IMAGE) deploy/
+	rm -f deploy/noc deploy/config.example.yaml
+	rm -rf deploy/tools
+
+# ── systemd deploy ──────────────────────────────────────────────────
+
 noc.service: noc.service.in
 	sed -e 's|@REPO@|$(REPO)|g' -e 's|@PATH@|$(PATH)|g' $< > $@