feat: containerize for mmd.i80.dk deployment via Gitea/Nomad

- Add Dockerfile (python:3.12-slim, HF_HOME=/app/data/hf-cache)
- Add mmd.nomad (multi-task: web=dashboard, worker=scheduler)
- Add .gitea/workflows/deploy.yml (build->Harbor, deploy->Nomad)
- Add scheduler.py (stdlib scheduler replaces cron in container)
- Add requirements.txt
- dashboard.py: LOG_DIR + PORT/HOST from env vars
- saxo_auth.py: TOKEN_FILE from SAXO_TOKEN_FILE env var
- .gitignore: proper ignores for container project

Volume moneymaker-data (/app/data) holds:
  - logs/ (shared between web+worker)
  - .saxo_token.json (pre-copy once after first deploy)
  - hf-cache/ (HuggingFace FinBERT cache)

Gitea secrets required: DATABASE_URL, ANTHROPIC_API_KEY,
SAXO_APP_KEY, SAXO_APP_SECRET_1, HARBOR_ROBOT_TOKEN

mmd.nomad

@@ -0,0 +1,155 @@
+job "moneymaker" {
+  region      = "global"
+  datacenters = ["dc1"]
+  type        = "service"
+
+  update {
+    stagger           = "30s"
+    max_parallel      = 1
+    canary            = 1
+    min_healthy_time  = "10s"
+    healthy_deadline  = "5m"
+    auto_revert       = true
+    auto_promote      = true
+    progress_deadline = "10m"
+  }
+
+  group "app" {
+    count = 1
+
+    network {
+      port "http" {}
+    }
+
+    reschedule {
+      attempts       = 5
+      interval       = "10m"
+      delay          = "30s"
+      delay_function = "exponential"
+      max_delay      = "120s"
+      unlimited      = false
+    }
+
+    constraint {
+      attribute = "${node.unique.name}"
+      value     = "autobox"
+    }
+
+    volume "moneymaker-data" {
+      type      = "host"
+      source    = "moneymaker-data"
+      read_only = false
+    }
+
+    service {
+      provider = "consul"
+      name     = "moneymaker"
+      port     = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.moneymaker.rule=Host(`mmd.i80.dk`)",
+        "traefik.http.routers.moneymaker.tls=true",
+      ]
+
+      canary_tags = [
+        "traefik.enable=false",
+      ]
+
+      check {
+        name     = "http_health_check"
+        type     = "http"
+        path     = "/health"
+        interval = "10s"
+        timeout  = "5s"
+
+        check_restart {
+          limit = 3
+          grace = "30s"
+        }
+      }
+    }
+
+    # -- Dashboard (Flask web app) ----------------------------------------
+    task "web" {
+      driver = "docker"
+
+      volume_mount {
+        volume      = "moneymaker-data"
+        destination = "/app/data"
+        read_only   = false
+      }
+
+      config {
+        image      = "registry.i80.dk/gitea/mmd:latest"
+        ports      = ["http"]
+        force_pull = true
+      }
+
+      restart {
+        attempts = 10
+        interval = "10m"
+        delay    = "10s"
+        mode     = "fail"
+      }
+
+      env {
+        APP_ENV           = "production"
+        PORT              = "${NOMAD_PORT_http}"
+        HOST              = "0.0.0.0"
+        LOG_DIR           = "/app/data/logs"
+        SAXO_TOKEN_FILE   = "/app/data/.saxo_token.json"
+        HF_HOME           = "/app/data/hf-cache"
+        DATABASE_URL      = "__DATABASE_URL__"
+        ANTHROPIC_API_KEY = "__ANTHROPIC_API_KEY__"
+        SAXO_APP_KEY      = "__SAXO_APP_KEY__"
+        SAXO_APP_SECRET_1 = "__SAXO_APP_SECRET_1__"
+      }
+
+      resources {
+        cpu    = 300
+        memory = 512
+      }
+    }
+
+    # -- Worker (pipeline scheduler, runs FinBERT + Claude) ----------------
+    task "worker" {
+      driver = "docker"
+
+      volume_mount {
+        volume      = "moneymaker-data"
+        destination = "/app/data"
+        read_only   = false
+      }
+
+      config {
+        image      = "registry.i80.dk/gitea/mmd:latest"
+        command    = "python"
+        args       = ["scheduler.py"]
+        force_pull = true
+      }
+
+      restart {
+        attempts = 10
+        interval = "10m"
+        delay    = "10s"
+        mode     = "fail"
+      }
+
+      env {
+        LOG_DIR           = "/app/data/logs"
+        SAXO_TOKEN_FILE   = "/app/data/.saxo_token.json"
+        HF_HOME           = "/app/data/hf-cache"
+        DATABASE_URL      = "__DATABASE_URL__"
+        ANTHROPIC_API_KEY = "__ANTHROPIC_API_KEY__"
+        SAXO_APP_KEY      = "__SAXO_APP_KEY__"
+        SAXO_APP_SECRET_1 = "__SAXO_APP_SECRET_1__"
+      }
+
+      resources {
+        cpu    = 1500
+        memory = 3072
+      }
+    }
+  }
+}