Add Docker image, Compose, CI/CD workflows and docs

- Multi-arch (amd64/arm64) panel image: static musl binary on scratch,
  cross-compiled with cargo-zigbuild (no QEMU), non-root, healthcheck
- docker-compose.yml + .env.example for one-command deployment
- CI: fmt, clippy, tests, web type-checks, Windows launcher build,
  real-network installs of vanilla/Fabric/Quilt/Forge/NeoForge,
  Docker build
- Release: Windows NSIS installer with baked-in panel URL, GHCR image
  push and GitHub release (tag push or manual dispatch)
- README, admin guide, Microsoft auth setup, architecture, development
- rustfmt config and formatting pass

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS

crates/core/src/paths.rs

@@ -49,12 +49,13 @@ impl Layout {
 
 /// Keep instance ids filesystem-safe no matter what the panel sends.
 pub fn sanitize_id(id: &str) -> String {
-    let s: String = id
-        .chars()
-        .map(|c| if c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.' { c } else { '_' })
-        .collect();
+    let s: String = id.chars().map(|c| if c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.' { c } else { '_' }).collect();
     let s = s.trim_matches('.').to_string();
-    if s.is_empty() { "_".into() } else { s }
+    if s.is_empty() {
+        "_".into()
+    } else {
+        s
+    }
 }
 
 /// Join a server-provided relative path onto `base`, refusing anything that
@@ -72,7 +73,11 @@ pub fn safe_join(base: &Path, rel: &str) -> Option<PathBuf> {
             p => out.push(p),
         }
     }
-    if out == base { None } else { Some(out) }
+    if out == base {
+        None
+    } else {
+        Some(out)
+    }
 }
 
 #[cfg(test)]