Rework how the production container is built

[rjsparks]

It's not necessary to base the container on opensuse, and there's a lot that's loaded that we don't need to load.

Let's rework this completely using docker compose.

The frontend should simply run gunicorn. The application use is very light so a small number of workers is acceptable.

Secrets will have to come in from somewhere - we can continue to map them in via a file-system mounted local.py, but I'm willing to consider other options.

We can have a separate database container - how should we deal with persisting its data? Do we map the underlying files out to the native filesystem?