feat: V2 microservices stack — backend services, gateway, JWT auth

Add full V2 architecture: identity, content, studio (.NET 10) and file,
render, notification, gateway (Go) services with vendored deps, plus DB
migrations, event/API contracts, and an init-db script.

Wire the Next.js frontend to the gateway: server-side JWT auth routes
(login/register/refresh/logout/me), gateway fetch helper, and session/
cookie/jwt helpers under src/lib.

Containerize the stack via docker-compose.v2.yml and per-service
Dockerfiles. Base images resolve through a Nexus mirror (Docker Hub) and
MCR directly; npm/NuGet pull from Nexus groups. Self-host fonts via
next/font/local to avoid Google Fonts (geo-blocked).

Add CI workflow and ignore .env.v2, *.stackdump, and .NET bin/obj.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

services/content/Dockerfile

@@ -0,0 +1,24 @@
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
+WORKDIR /app
+EXPOSE 8080
+# The .NET base image ships neither wget nor curl, which the container healthcheck needs.
+# Copy a single static busybox binary named `wget` (busybox dispatches on argv[0]).
+# This stays fully offline — no apt/network — matching the vendored Go builds.
+COPY --from=busybox:1.36 /bin/busybox /usr/bin/wget
+
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+# Restore is its own cached layer: it only re-runs when the .csproj (deps) changes,
+# not on every source edit. Critical here — NuGet restore is the slow step.
+COPY NuGet.Config .
+COPY ["FlatRender.ContentSvc/FlatRender.ContentSvc.csproj", "FlatRender.ContentSvc/"]
+RUN dotnet restore "FlatRender.ContentSvc/FlatRender.ContentSvc.csproj"
+COPY . .
+# Single publish compiles + packages; --no-restore reuses the cached restore above.
+RUN dotnet publish "FlatRender.ContentSvc/FlatRender.ContentSvc.csproj" \
+    -c Release -o /app/publish --no-restore /p:UseAppHost=false
+
+FROM base AS final
+WORKDIR /app
+COPY --from=build /app/publish .
+ENTRYPOINT ["dotnet", "FlatRender.ContentSvc.dll"]