add suite: all-in-one Docker image with noc + Gitea

- Switch to rustls (drop OpenSSL dependency) for musl static build
- Add deploy/ with Dockerfile and entrypoint (Gitea auto-setup + admin token)
- Add Makefile targets: build-musl, docker
- Add doc/suite.md: design doc for human-AI collaboration interfaces

deploy/Dockerfile

@@ -0,0 +1,35 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates git curl sqlite3 jq \
+    && rm -rf /var/lib/apt/lists/*
+
+# install gitea
+ARG GITEA_VERSION=1.23.7
+RUN curl -fSL "https://dl.gitea.com/gitea/${GITEA_VERSION}/gitea-${GITEA_VERSION}-linux-amd64" \
+        -o /usr/local/bin/gitea \
+    && chmod +x /usr/local/bin/gitea
+
+# noc binary (pre-built musl static binary)
+COPY noc /usr/local/bin/noc
+RUN chmod +x /usr/local/bin/noc
+
+COPY tools/ /opt/noc/tools/
+COPY config.example.yaml /opt/noc/config.example.yaml
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+RUN useradd -m -s /bin/bash noc \
+    && mkdir -p /data/gitea /data/noc \
+    && chown -R noc:noc /data /opt/noc
+VOLUME ["/data"]
+USER noc
+
+ENV RUST_LOG=noc=info \
+    NOC_CONFIG=/data/noc/config.yaml \
+    NOC_STATE=/data/noc/state.json \
+    GITEA_WORK_DIR=/data/gitea
+
+EXPOSE 3000
+
+ENTRYPOINT ["/entrypoint.sh"]