Multi-stage build: rust:1-slim-bookworm to compile (needs a recent
toolchain per smarm/urus's MSRV), then a distroless/cc runtime image
since the binary only links against glibc/libgcc/libm (checked via
ldd) - no shell or package manager needed at runtime, ~27MB vs ~87MB
for a debian-slim runtime.
- CCC_DB_PATH defaults to /data/cdn.db in-container
- docker-compose.yml persists /data in a named volume, maps 8333
