feat: optional self-host (Docker) mode — additive, zero-dep

[heznpc]

Summary

Adds a standalone server.js + Dockerfile so anyone can run ProfileKit
on their own infrastructure without going through Vercel. The Vercel path
(api/[endpoint].js) is unchanged and remains the default; the self-host
path reuses the exact same handler files via a thin adapter.

What ships

• server.js — Node 22 http server with the same ALLOWED gate as the Vercel router, Express-style req/res adapter, static public/ serving with traversal guard, X-ProfileKit-Instance header on every response, graceful SIGTERM/SIGINT shutdown. Only auto-listens when run directly.
• Dockerfile — node:22-slim, USER node, HEALTHCHECK via Node 22 fetch (no curl install), no npm install step (zero deps). Builds in seconds.
• .dockerignore — trims tests/docs/examples/.git from the build context.
• examples/self-host/ — docker compose up --build --scale web=3 brings up 3 app replicas behind nginx round-robin. 128 MB / 0.5 CPU per replica mirrors the Vercel function budget. README documents the per-process token-pool limitation.
• tests/server.test.js — 11 new smoke tests (197/197 total).
• .github/workflows/ci.yml — new docker job builds the image, waits for HEALTHCHECK, then independently curls /api/health and /api/divider.
• README — 5-label block updated; Self-hosting split into Path A (Vercel default) + Path B (Docker).

Constraints honored

• Zero runtime npm dependencies preserved (package.json still has no dependencies / devDependencies).
• Same SSRF / XSS guards via shared handlers; ALLOWED gate + path-traversal guard on the new path.
• Host header untrusted (URL parsed against a fixed origin).
• No untrusted GitHub event data in any run: step of the new CI job.

Verified locally

docker build -t profilekit:local .   # succeeds
docker run -d -p 13000:3000 profilekit:local
curl -s http://localhost:13000/api/health        # ok:true
curl -sI http://localhost:13000/api/health       # X-ProfileKit-Instance: <container-id>
curl -s -o /dev/null -w '%{content_type}\n' \
  'http://localhost:13000/api/divider?style=line'  # image/svg+xml

Test plan

• npm run check — clean (now covers root server.js too)
• npm test — 197/197 (was 186 + 11 new server tests)
• Local docker build + run smoke
• CI matrix test (22) / test (24) green
• CI docker job green