Add slim Phase 1 task 1.11 (Dockerfile + Gitea workflow) for pilot deploy

- Multi-stage Dockerfile (Node 22 alpine, BuildKit cache, non-root user).
  HEALTHCHECK and metrics port (9090) deferred until task 1.10 ships;
  comments document the resume.
- .gitea/workflows/build.yml — single build job following the pattern
  of other TRM repos (no services/container, ubuntu-latest direct).
  Tests + typecheck + lint inline; image tagged :main.
- compose.dev.yaml — local-build variant for verifying Dockerfile
  changes pre-push. Production deploy lives in the sibling deploy/ repo.
- .env.example documenting all runtime env vars.
- README updated to point at deploy/ for production and explain CI.
- Task 1.11 marked done (slim variant) in ROADMAP and task file.

.env.example

@@ -0,0 +1,37 @@
+# Environment variables for tcp-ingestion.
+# Copy to .env and fill in values for local development.
+# All variables are optional except REDIS_URL.
+
+# Runtime environment: development | test | production
+NODE_ENV=development
+
+# Unique identifier for this service instance (used in logs and Redis keys).
+# Defaults to a random local-<uuid-prefix> if not set.
+INSTANCE_ID=local-1
+
+# Log level: fatal | error | warn | info | debug | trace
+LOG_LEVEL=info
+
+# TCP port the service listens on for Teltonika device connections.
+TELTONIKA_PORT=5027
+
+# Redis connection URL — required; no default.
+REDIS_URL=redis://localhost:6379
+
+# Redis Stream name for normalized Position records.
+REDIS_TELEMETRY_STREAM=telemetry:teltonika
+
+# Maximum number of entries to retain in the Redis Stream (XADD MAXLEN ~).
+REDIS_STREAM_MAXLEN=1000000
+
+# Port for the Prometheus /metrics HTTP server.
+# NOTE: No HTTP server runs today — this is reserved for task 1.10 (observability).
+METRICS_PORT=9090
+
+# In-memory publisher queue capacity before overflow (oldest records dropped).
+PUBLISH_QUEUE_CAPACITY=10000
+
+# Strict device auth: reject connections from IMEIs not in the Redis allow-list.
+# Requires task 1.13 (RedisAllowListAuthority) to be deployed and configured.
+# Default false (AllowAllAuthority accepts every IMEI).
+STRICT_DEVICE_AUTH=false