feat: add Dockerfile + --host flag for containerized deployment

Adds a multi-stage Dockerfile (rust:1-slim-bookworm builder → distroless/cc
runtime) plus a --host flag for obscura serve that defaults to 127.0.0.1
for safety but can be set to 0.0.0.0 so the container's port is reachable
via docker run -p mapping.

Dockerfile cherry-picked from #84. The SPA chunk loading commit from that
PR was left out — verified it didn't actually fix the Next.js webpack
errors on kiwi.com (#86).

crates/obscura-cdp/src/server.rs

@@ -46,13 +46,26 @@ pub async fn start_with_full_options(
     stealth: bool,
     user_agent: Option<String>,
 ) -> anyhow::Result<()> {
-    let addr = SocketAddr::from(([127, 0, 0, 1], port));
+    start_with_host(port, "127.0.0.1", proxy, stealth, user_agent).await
+}
+
+pub async fn start_with_host(
+    port: u16,
+    host: &str,
+    proxy: Option<String>,
+    stealth: bool,
+    user_agent: Option<String>,
+) -> anyhow::Result<()> {
+    let ip: std::net::IpAddr = host
+        .parse()
+        .map_err(|e| anyhow::anyhow!("invalid --host '{}': {}", host, e))?;
+    let addr = SocketAddr::new(ip, port);
     let listener = TcpListener::bind(&addr).await?;
 
-    info!("Obscura CDP server listening on ws://127.0.0.1:{}", port);
+    info!("Obscura CDP server listening on ws://{}:{}", host, port);
     info!(
-        "DevTools endpoint: ws://127.0.0.1:{}/devtools/browser",
-        port
+        "DevTools endpoint: ws://{}:{}/devtools/browser",
+        host, port
     );
 
     let local = tokio::task::LocalSet::new();