Add multi-arch Docker build and docker-compose stack

Introduce a multi-stage Alpine Dockerfile that cross-compiles via
buildx ($BUILDPLATFORM -> $TARGETARCH) so a single invocation produces
both linux/amd64 and linux/arm64 images without a qemu-emulated
builder. `make docker` loads the native-arch image locally for smoke
tests; `make docker-push` publishes a multi-arch manifest. Ship a
docker-compose.yaml with opt-in profiles for maglevd/frontend and a
.env.example template so operators can mirror /etc/default/vpp-maglev
muscle memory into containers.

.env.example

@@ -0,0 +1,90 @@
+# .env.example — docker-compose.yaml environment for vpp-maglev{d,-frontend}
+#
+# Copy to .env and edit. `.env` is gitignored so credentials stay local.
+#
+#   cp .env.example .env
+#   $EDITOR .env
+#   docker compose up -d
+
+# ---------------------------------------------------------------------------
+# Which containers start
+# ---------------------------------------------------------------------------
+# Docker Compose "profiles" decide which services actually start when you
+# run `docker compose up`. Set COMPOSE_PROFILES below to a comma-separated
+# list of the services you want. Valid values:
+#
+#   maglevd    — the health-checker daemon (needs VPP on the host)
+#   frontend   — the read-only web dashboard
+#
+# Leave empty (or delete the line) to start nothing. The two services
+# are fully independent — you can run just the frontend (IPng's default),
+# just the daemon, or both.
+#
+# IPng default: frontend only, connecting to remote maglevds.
+COMPOSE_PROFILES=frontend
+
+# Examples:
+#COMPOSE_PROFILES=maglevd,frontend    # both (typical single-host deploy)
+#COMPOSE_PROFILES=maglevd             # daemon only (headless fleet member)
+#COMPOSE_PROFILES=                    # nothing
+
+# ---------------------------------------------------------------------------
+# maglevd — the health-checker daemon
+# ---------------------------------------------------------------------------
+# The variable names below mirror /etc/default/vpp-maglev on a Debian
+# install, so an operator moving between bare-metal and containers can
+# reuse muscle memory. Each variable is read by the daemon via a
+# stringFlag(..., MAGLEV_*, ...) fallback in cmd/server/main.go.
+
+# Path to the YAML config INSIDE the container. Mount your maglev.yaml
+# at this path — the shipped docker-compose.yaml mounts ./maglev.yaml
+# from the repo root, so drop your file there or edit the volume line.
+MAGLEV_CONFIG=/etc/vpp-maglev/maglev.yaml
+
+# gRPC listen address inside the container. The compose file publishes
+# port 9090 regardless; keep this as :9090 unless you know why.
+MAGLEV_GRPC_ADDR=:9090
+
+# Prometheus /metrics listen address. Empty string disables it.
+MAGLEV_METRICS_ADDR=:9091
+
+# VPP binary-API and stats sockets. The compose file bind-mounts
+# /run/vpp from the host so these resolve when the daemon runs on a
+# host that also runs VPP. On a host without VPP the maglevd profile
+# should not be activated — but if it is, maglevd will log repeated
+# reconnect failures and the LB reconciler will stay idle.
+MAGLEV_VPP_API_ADDR=/run/vpp/api.sock
+MAGLEV_VPP_STATS_ADDR=/run/vpp/stats.sock
+
+# Log verbosity: debug, info, warn, error.
+MAGLEV_LOG_LEVEL=info
+
+# ---------------------------------------------------------------------------
+# maglevd-frontend — the read-only web dashboard
+# ---------------------------------------------------------------------------
+
+# Comma-separated list of maglevd gRPC addresses. Two common cases:
+#
+#   - Same-host stack (COMPOSE_PROFILES=maglevd,frontend): the frontend
+#     reaches the daemon via Docker's internal DNS, so "maglevd:9090"
+#     works out of the box.
+#
+#   - Frontend-only host (IPng case): list one or more remote maglevd
+#     addresses, e.g. "chbtl2.ipng.ch:9090,chlzn1.ipng.ch:9090".
+MAGLEV_FRONTEND_SERVERS=maglevd:9090
+
+# HTTP bind address inside the container. The compose file publishes
+# port 8080 regardless.
+MAGLEV_FRONTEND_LISTEN=:8080
+
+# Log verbosity: debug, info, warn, error.
+MAGLEV_FRONTEND_LOG_LEVEL=info
+
+# Optional basic-auth credentials for the /admin/ surface. When BOTH
+# are set and non-empty, /admin/ is reachable and the SPA exposes
+# backend lifecycle mutations (pause, resume, enable, disable,
+# set-weight). When either is missing, /admin/ returns 404 and the
+# SPA hides the admin toggle entirely. Leave commented for a strictly
+# read-only deployment.
+#MAGLEV_FRONTEND_USER=admin
+#MAGLEV_FRONTEND_PASSWORD=changeme