Add a container image for the server

Why: the server is a single static binary with no dependencies, so its
container should be nothing but that binary. Shipping one also makes the
master key easy to lose, which needed handling rather than documenting.

What:
- Dockerfile: two stages, runtime is scratch plus the binary and a CA bundle
  for reaching an OIDC provider, running as uid 65532. About 9 MB. The build
  stage copies only go.mod, cmd/keeporgd and internal, so client or docs
  changes do not invalidate it.
- The image has no shell, so HEALTHCHECK runs `keeporgd -healthcheck`, a new
  flag that probes /healthz on the configured address and exits non-zero
  with a reason. podman needs --format docker to keep the healthcheck at
  all, which the Makefile passes when it picks podman.
- New -master-key-file flag, so a mounted secret works without a config file.
- The server now checks at startup whether the master key still opens the
  stored vault keys, and says so. Without it, a container restarted without
  its key discovers the problem one failed merge at a time.
- make docker, docker-run and docker-save; a compose example with read_only,
  cap_drop ALL and no-new-privileges.
- The client and the server now version independently, so their Debian
  changelogs are split per package and `make changelog` takes PKG=.
  Server 0.3.0; the clients stay at 0.2.0.

Proved: built with podman and run. The container serves /healthz and /web,
its own healthcheck reports healthy, and a vault created through it was
edited from the same base by keepassxc-cli twice, merged by the server into
version 3, and read back with both entries intact. Restarted without the
master key it warns "1 of 1 stored vault keys do not open with this master
key" and answers a merging push with 409 merge_failed, leaving the vault
untouched; restored, it logs "1 vault keys available for merging" and merges
again. The same key supplied through -master-key-file from a mounted file
works identically. Both .deb packages build with their own changelog, and
make check is clean.

cmd/keeporgd/main.go

@@ -6,11 +6,13 @@ package main
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
 	"log"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -81,8 +83,13 @@ func main() {
 		addr       = flag.String("addr", "", "listen address (overrides the config file)")
 		dataDir    = flag.String("data", "", "data directory (overrides the config file)")
 		extURL     = flag.String("url", "", "externally reachable base URL (overrides the config file)")
+		masterKey  = flag.String("master-key-file", "",
+			"file holding the base64 master key that wraps the vault keys; "+
+				"$"+secret.MasterKeyEnv+" takes precedence over it")
 		showVer    = flag.Bool("version", false, "print the version and exit")
-		writeCfg   = flag.String("write-config", "", "write a commented example config to this path and exit")
+		healthOnly = flag.Bool("healthcheck", false,
+			"probe a running server on this address and exit 0 if it is healthy")
+		writeCfg = flag.String("write-config", "", "write a commented example config to this path and exit")
 	)
 	flag.Parse()
 
@@ -118,6 +125,18 @@ func main() {
 	if *extURL != "" {
 		cfg.ExternalURL = *extURL
 	}
+	if *masterKey != "" {
+		cfg.MasterKeyFile = *masterKey
+	}
+
+	if *healthOnly {
+		// The container image has no shell, so the binary probes itself.
+		if err := healthcheck(cfg); err != nil {
+			fmt.Fprintln(os.Stderr, "unhealthy:", err)
+			os.Exit(1)
+		}
+		return
+	}
 
 	srv, err := server.New(cfg, lg)
 	if err != nil {
@@ -205,6 +224,38 @@ func bootstrap(srv *server.Server, lg *log.Logger) error {
 	return nil
 }
 
+// healthcheck asks a server listening on this configuration whether it is
+// serving, and says why not when it is not.
+func healthcheck(cfg server.Config) error {
+	cfg.Defaults()
+	host, port, err := net.SplitHostPort(cfg.Addr)
+	if err != nil {
+		return fmt.Errorf("address %q: %w", cfg.Addr, err)
+	}
+	if host == "" || host == "0.0.0.0" || host == "::" {
+		host = "127.0.0.1"
+	}
+	scheme := "http"
+	client := &http.Client{Timeout: 5 * time.Second}
+	if cfg.TLSCert != "" && cfg.TLSKey != "" {
+		scheme = "https"
+		// A loopback probe of our own listener: the certificate's name is
+		// the public one, which this connection is not using.
+		client.Transport = &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
+		}
+	}
+	resp, err := client.Get(scheme + "://" + net.JoinHostPort(host, port) + "/healthz")
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("/healthz returned %s", resp.Status)
+	}
+	return nil
+}
+
 func writeExampleConfig(path string) error {
 	ex := fileConfig{
 		Addr:            ":8765",