feat(infra): run Kubo in docker-compose (server profile, pinned version) #59

Summary

Add an always-on Kubo node to the compose stack as the platform's content node.

Estimated size: M

Motivation

Browser Helia nodes come and go; an always-on peer is what lets a shared CID open on another machine.

Current state in this repo

• docker-compose.yaml runs backend and caddy; there is no IPFS node.

Proposal

• Add a kubo service with a pinned image tag (not latest), a persistent volume and the server config profile applied at init.
• Publish swarm (4001 tcp/udp) as needed; keep the RPC API (5001) on the compose network only; publish the gateway (8080) to localhost in dev.
• Add a healthcheck and a README section recording the Kubo version and the config keys used, with a link to the docs for that version (verify every setting against the release you pin).

Acceptance criteria

• docker compose up kubo becomes healthy.
• A script performs add then cat through the node and prints matching CIDs.
• The RPC port is unreachable from outside the compose network.
• No secrets are committed.

Out of scope

• Production hosting; browser transports; auth (separate issues).

Dependencies

• None; can be picked up independently.

Testing plan

• Smoke script in scripts/; later wired into CI by the integration-test issue.

Part of #43. Ground rules for the content layer: no secrets in the repo, content-layer failures must never block or discard quantum execution, and tests and docs ship with every PR.