Add Docker image, Compose, CI/CD workflows and docs

- Multi-arch (amd64/arm64) panel image: static musl binary on scratch,
  cross-compiled with cargo-zigbuild (no QEMU), non-root, healthcheck
- docker-compose.yml + .env.example for one-command deployment
- CI: fmt, clippy, tests, web type-checks, Windows launcher build,
  real-network installs of vanilla/Fabric/Quilt/Forge/NeoForge,
  Docker build
- Release: Windows NSIS installer with baked-in panel URL, GHCR image
  push and GitHub release (tag push or manual dispatch)
- README, admin guide, Microsoft auth setup, architecture, development
- rustfmt config and formatting pass

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS

crates/core/src/rules.rs

@@ -57,7 +57,11 @@ impl Env {
 
     /// `${arch}` substitution used in legacy native classifiers.
     pub fn bits(&self) -> &'static str {
-        if self.arch == "x86" { "32" } else { "64" }
+        if self.arch == "x86" {
+            "32"
+        } else {
+            "64"
+        }
     }
 }
 
@@ -126,10 +130,7 @@ mod tests {
 
     #[test]
     fn evaluates_rules() {
-        let rules: Vec<Rule> = serde_json::from_str(
-            r#"[{"action":"allow"},{"action":"disallow","os":{"name":"osx"}}]"#,
-        )
-        .unwrap();
+        let rules: Vec<Rule> = serde_json::from_str(r#"[{"action":"allow"},{"action":"disallow","os":{"name":"osx"}}]"#).unwrap();
         assert!(allowed(&rules, &env("windows")));
         assert!(!allowed(&rules, &env("osx")));