Establish OA/SA prototype baseline and first-release work

deployment/Dockerfile

@@ -0,0 +1,18 @@
+FROM rust:1.90-bookworm AS builder
+WORKDIR /src
+COPY Cargo.toml Cargo.lock ./
+COPY crates ./crates
+COPY docs/openapi.json ./docs/openapi.json
+RUN cargo build --release --locked -p oa-server
+
+FROM debian:bookworm-slim
+RUN groupadd --gid 10001 arcadia \
+    && useradd --uid 10001 --gid 10001 --no-create-home --home-dir /data arcadia \
+    && mkdir /data \
+    && chown 10001:10001 /data
+COPY --from=builder /src/target/release/arcadia-server /usr/local/bin/arcadia-server
+USER 10001:10001
+VOLUME ["/data"]
+EXPOSE 8787
+ENTRYPOINT ["/usr/local/bin/arcadia-server"]
+CMD ["--bind", "0.0.0.0:8787", "--data-dir", "/data", "--token-file", "/run/secrets/arcadia-token"]

deployment/Dockerfile.dockerignore

@@ -0,0 +1,9 @@
+.git
+target
+dist
+harness
+**/target
+**/*.sqlite3
+**/*.log
+.codex
+.openai

deployment/arcadia-server.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Arcadia Studio model REST service
+After=network.target
+
+[Service]
+Type=simple
+User=arcadia
+Group=arcadia
+StateDirectory=arcadia
+StateDirectoryMode=0700
+ExecStart=/usr/local/bin/arcadia-server --bind 127.0.0.1:8787 --data-dir /var/lib/arcadia --token-file /etc/arcadia/token
+Restart=on-failure
+RestartSec=2
+TimeoutStopSec=45
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target