Build dependencies in a cached layer and document running the image

The instance configuration is mounted at /etc/meguri/config.yaml, which is now
the default MEGURI_CONFIG_FILE; the image ships the cytoscape license too.

Co-Authored-By: Claude <noreply@anthropic.com>

Dockerfile

@@ -1,15 +1,31 @@
+# syntax=docker/dockerfile:1
+# Build:  docker build -t meguri .
+# Run:    docker run -p 3000:3000 \
+#           -e DATABASE_URL=postgresql://USER:PASSWORD@HOST:5432/meguri \
+#           -e MEGURI_PUBLIC_URL=https://meguri.example.internal \
+#           -e MEGURI_OIDC_CLIENT_SECRET=... \
+#           -v ./instance-config.yaml:/etc/meguri/config.yaml:ro meguri
+# The instance configuration (workspaces, group mappings, sign-in) is mounted, never baked in.
+# See deploy/instance-config.example.yaml and docs/deployment.md.
+
 FROM rust:1.97-bookworm AS build
 WORKDIR /build
+# Compile dependencies in their own layer so source edits do not rebuild them.
 COPY Cargo.toml Cargo.lock ./
+RUN mkdir src && echo 'fn main() {}' > src/main.rs && touch src/lib.rs \
+    && cargo build --locked --release && rm -rf src
 COPY src ./src
 COPY static ./static
-RUN cargo build --locked --release
+RUN touch src/main.rs src/lib.rs && cargo build --locked --release
 
 FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 COPY --from=build /build/target/release/meguri /usr/local/bin/meguri
 COPY static/vendor/ALPINE-LICENSE.md /usr/share/licenses/meguri/alpine-MIT.md
+COPY static/vendor/cytoscape.LICENSE /usr/share/licenses/meguri/cytoscape-MIT.md
 USER 65532:65532
-ENV MEGURI_BIND=0.0.0.0:3000
+ENV MEGURI_BIND=0.0.0.0:3000 \
+    MEGURI_CONFIG_FILE=/etc/meguri/config.yaml
 EXPOSE 3000
 ENTRYPOINT ["/usr/local/bin/meguri"]