Add Docker Compose deployment with Cloudflare Tunnel

[santaklouse]

Summary

• add a hardened multi-stage Docker image for the relay
• add a Docker Compose stack with no host-published ports and Cloudflare Tunnel ingress
• support a container-only public listener while keeping the admin listener loopback-only
• document Cloudflare hostname, token, and startup configuration in English and Russian

Validation

• /opt/homebrew/bin/go test ./...
• CLOUDFLARE_TUNNEL_TOKEN=test-token docker compose config
• CLOUDFLARE_TUNNEL_TOKEN=test-token docker compose build tproxy-server
• CLOUDFLARE_TUNNEL_TOKEN=test-token docker compose run --rm tproxy-server -config /etc/tproxy-server/config.json -check
• verified the relay has no host port bindings (8080/tcp: null)