feat(paseo): add paseo service with Claude Code preinstalled

The upstream image ships no agent CLIs, so build from a local Dockerfile
that layers Claude Code on top. npm delivers the same native binary as
the standalone installer, which cannot be used here: it writes to
$HOME/.local, and $HOME is /home/paseo, a volume mount that masks
anything baked in at build time.

Runs as root by design -- the entrypoint chowns the mounted volumes and
then drops to the unprivileged paseo user with gosu.

paseo/.env.example

@@ -0,0 +1,11 @@
+# Copy to .env and fill in. Never commit .env.
+#
+#   cp .env.example .env
+
+# Password for the daemon API and web UI.
+# Generate one with: openssl rand -base64 24
+PASEO_PASSWORD=
+
+# Comma-separated DNS names allowed to reach the daemon. The domain mapped in
+# Coolify/Dokploy must be listed here. IPs and localhost are always allowed.
+PASEO_HOSTNAMES=