feat(selfhost): containerize for Coolify + decommission AWS deploy

Add multi-stage Dockerfile, docker-compose.yml for local dev, .env.example template,
and Makefile helpers. Disable GitHub Actions AWS deploy workflow. Supports Coolify
container orchestration for self-hosted deployments.

.env.example

@@ -0,0 +1,47 @@
+# miti99bot — self-host (Coolify + MongoDB Atlas) environment.
+# Copy to .env and fill in. .env is gitignored — never commit real secrets.
+
+# ============================ Required ============================
+# Telegram bot token from @BotFather.
+TELEGRAM_BOT_TOKEN=123456:ABC-DEF...
+
+# MongoDB Atlas connection. MONGO_URL is the full SRV string INCLUDING the
+# db username + password — treat it as a secret (it is never logged).
+# Create a least-privilege user: readWrite on this one database only.
+MONGO_URL=mongodb+srv://botuser:STRONG_UNIQUE_PASSWORD@cluster0.xxxxx.mongodb.net/?retryWrites=true&w=majority
+MONGO_DATABASE=miti99bot
+
+# ============================ Operational =========================
+# Comma-separated module list. Empty = load every module.
+MODULES=
+# Telegram user id for owner-only commands (renamed from BOT_OWNER_ID).
+OWNER_ID=
+# Comma-separated admin Telegram user ids (renamed from ADMIN_USER_IDS).
+ADMIN_IDS=
+
+# ============================ Optional ============================
+# Only the twentyq module needs this. Leave blank to disable that command.
+GEMINI_API_KEY=
+
+# GIT_SHA is injected at build time by Coolify for the deploynotify owner DM.
+# Leave unset for local `docker compose up` — deploynotify just stays silent.
+# GIT_SHA=
+
+# ====================== Leave UNSET on self-host ==================
+# These are AWS-only. cmd/server reads secrets directly from the plain env
+# vars above; *_PARAMETER_NAME would force an SSM lookup that FAILS with no AWS
+# credentials and bricks startup. Do NOT set any of them:
+#   TELEGRAM_BOT_TOKEN_PARAMETER_NAME
+#   TELEGRAM_WEBHOOK_SECRET_PARAMETER_NAME
+#   CRON_SHARED_SECRET_PARAMETER_NAME
+#   GEMINI_API_KEY_PARAMETER_NAME
+#   STOCK_INCOME_EVENTS_API_TOKEN_PARAMETER_NAME
+#   GOLD_VNAPP_API_KEY_PARAMETER_NAME
+#
+# Also leave unset (defaults are correct for self-host):
+#   KV_PROVIDER          — auto-selects mongodb because MONGO_URL is set
+#   PORT                 — defaults to 8080 (internal health server)
+#   TELEGRAM_WEBHOOK_SECRET — long polling has no webhook
+#   CRON_SHARED_SECRET   — unset → /cron route 404s; the in-process scheduler is the trigger
+#   GOLD_VNAPP_API_KEY   — gold module auto-fetches + caches the key to Mongo
+#   STOCK/COIN/GOLD *_API_URL overrides — modules use their coded default providers