Dokploy deploy: Dockerfile, DB CA cert, blog images, CSP

- Add Dockerfile (multi-stage Node 20), .dockerignore, docker-compose.yml, and
  DEPLOY-DOKPLOY.md for container deployment on Dokploy.
- Commit the DigitalOcean managed-Postgres Project CA cert (certs/ca-certificate.crt)
  so production TLS verification (fail-closed) works in-container. Public CA, safe to commit.
- Blog cover images served from DO Spaces; allow *.digitaloceanspaces.com in the prod CSP img-src.
- Includes the AI (case summaries) and Cloudflare Turnstile bot-protection features.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/web/src/pages/blog/BlogPostPage.tsx

@@ -48,6 +48,14 @@ export default function BlogPostPage() {
           </div>
         </header>
 
+        {post.coverImage && (
+          <img
+            src={post.coverImage}
+            alt=""
+            className="mb-10 aspect-[16/9] w-full rounded-2xl border border-ink-100 object-cover"
+          />
+        )}
+
         <div className="space-y-5">
           {post.body.map((b, i) => (
             <RenderBlock key={i} block={b} />