chore: add production deployment config and upgrade path requirements

- Add docker-compose.yml and docker-compose.example.yml for production deployment
- Add .env.example with all required environment variables
- Update architect agent with upgrade path requirements
- Update developer agent with migration best practices
- Add Phase 3 design documents (v0.3.0)
- Add ADR-0006 for participant state management

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker-compose.example.yml

@@ -0,0 +1,72 @@
+# Sneaky Klaus - Example Docker Compose Configuration
+#
+# Copy this file to docker-compose.yml and customize for your environment.
+#
+# Quick Start:
+#   1. cp docker-compose.example.yml docker-compose.yml
+#   2. Create .env file with your configuration (see .env.example)
+#   3. docker compose up -d
+#   4. Visit http://localhost:8000 to set up your admin account
+#
+# Upgrading:
+#   docker compose pull
+#   docker compose up -d
+#   (Migrations run automatically on container start)
+
+version: "3.8"
+
+services:
+  sneaky-klaus:
+    image: git.thesatelliteoflove.com/phil/sneakyklaus:latest
+    container_name: sneaky-klaus
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+    environment:
+      # Required: Generate a secure secret key
+      # Example: python -c "import secrets; print(secrets.token_hex(32))"
+      - SECRET_KEY=${SECRET_KEY:?SECRET_KEY is required}
+
+      # Required for production email sending via Resend
+      # Get your API key at https://resend.com
+      - RESEND_API_KEY=${RESEND_API_KEY:-}
+
+      # Email sender address (must be verified domain with Resend)
+      - EMAIL_FROM=${EMAIL_FROM:-noreply@example.com}
+
+      # Public URL of your application (used in magic link emails)
+      - APP_URL=${APP_URL:-http://localhost:8000}
+
+      # Environment: 'production' or 'development'
+      # In development mode, emails are logged to stdout instead of sent
+      - FLASK_ENV=${FLASK_ENV:-production}
+    volumes:
+      # Persistent storage for SQLite database and session files
+      # Database migrations are applied automatically on container start
+      - sneaky-klaus-data:/app/data
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+volumes:
+  sneaky-klaus-data:
+    driver: local
+
+# Optional: Add a reverse proxy for HTTPS
+# Example with Traefik:
+#
+# services:
+#   sneaky-klaus:
+#     labels:
+#       - "traefik.enable=true"
+#       - "traefik.http.routers.sneaky-klaus.rule=Host(`secretsanta.example.com`)"
+#       - "traefik.http.routers.sneaky-klaus.tls.certresolver=letsencrypt"
+#     networks:
+#       - traefik
+#
+# networks:
+#   traefik:
+#     external: true