docs: add Dockerfile + Build section to README

Closes two real gaps a fresh reader hits today:

- The README jumped straight to `tuyau server ...` with no path to
  actually get the binary. New "Build" section covers cargo build /
  cargo install / docker build, plus a note for embedders (axum
  feature on tuyau-client).
- examples/docker-compose.yml referenced `tuyau:latest` with a comment
  pointing at `docker build -t tuyau .` — but no Dockerfile existed.
  Added a minimal multi-stage Dockerfile (rust:1-slim build →
  debian:bookworm-slim runtime, ca-certificates for rustls-acme,
  non-root user). The compose example now actually works.

Dockerfile not smoke-tested locally (no docker daemon in this env);
standard multi-stage Rust pattern, no surprises.

Author: max-lt

.dockerignore

@@ -0,0 +1,2 @@
+target
+.git

Dockerfile

@@ -0,0 +1,18 @@
+# Multi-stage build for the `tuyau` binary (both `server` and `client`
+# subcommands live in one binary).
+
+FROM rust:1-slim AS build
+WORKDIR /src
+COPY . .
+RUN cargo build --release --bin tuyau
+
+FROM debian:bookworm-slim
+# ca-certificates: rustls-acme validates the ACME directory's TLS chain
+# against the system trust store when the `[acme]` block is enabled.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+RUN useradd --system --no-create-home --shell /usr/sbin/nologin tuyau
+COPY --from=build /src/target/release/tuyau /usr/local/bin/tuyau
+USER tuyau
+ENTRYPOINT ["tuyau"]

README.md

@@ -45,6 +45,26 @@ a local service.
   TLS-ALPN-01. Without it, the public listener serves a dev self-signed
   multi-SAN cert (`curl -k` works; browsers complain).
 
+## Build
+
+Requires Rust 1.85+ (edition 2024). Both `server` and `client` ship as
+subcommands of the same `tuyau` binary.
+
+```bash
+cargo build --release                     # binary at target/release/tuyau
+cargo install --path crates/tuyau-cli     # or put `tuyau` on PATH
+```
+
+Container image (server + client in one):
+
+```bash
+docker build -t tuyau .
+```
+
+Embedding the client as a library: add `tuyau-client` as a dependency and
+enable the `axum` feature for the [`axum::serve`](#3-or-embed-it-in-your-axum-app)
+adapter.
+
 ## Quick start
 
 ### 1. Run the server

examples/docker-compose.yml

@@ -13,7 +13,7 @@
 
 services:
   tuyau-client:
-    image: tuyau:latest # build locally for now: `docker build -t tuyau .`
+    image: tuyau:latest # built from the repo Dockerfile: `docker build -t tuyau .`
     # --ingress maps each public hostname to a local service. Repeatable.
     # Here "app" is another service on the compose network.
     command: ["client", "--ingress", "alpha.example.com=app:8080"]