chore: Halkyon Learn moves into apps/learn

Its server, client, app and curator, and the tools that write its
assets (maps, Anki fixtures, icons), as they are; paths are fixed in
the commits that follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/learn/halkyon_learn_server/Dockerfile

@@ -0,0 +1,71 @@
+# The server image. Built from the repository root (the build context), because the
+# workspace's root pubspec and lockfile live there:
+#
+#   docker build -f halkyon_learn_server/Dockerfile .
+#
+# Based on Serverpod's template, with three changes: Dart 3.13 (our SDK floor), an
+# Ubuntu 24.04 runtime instead of alpine + Dart's minimal glibc runtime (same
+# distribution as our servers; complete glibc, which Serverpod 4's bundled SQLite
+# libraries need), and a start command that passes Docker's stop signal on.
+
+# ── Build stage: compile the server to a native executable ────────────────────────
+FROM dart:3.13.4 AS build
+WORKDIR /app
+COPY pubspec.yaml pubspec.lock ./
+COPY halkyon_learn_server halkyon_learn_server
+
+# The workspace root with only the server package: neither the client package nor the
+# curator is needed to build the server, and the Flutter app would need Flutter.
+# Everything else stays as the repository has it, above all the dependency overrides,
+# which bring the server our fork of the offline sync package (fetched with the git
+# the Dart image has). The check fails the build loudly if the root's member list
+# changes shape.
+RUN sed -i -e '/^  - halkyon_learn_client$/d' -e '/^  - halkyon_learn_flutter$/d' \
+      -e '/^  - halkyon_learn_curator$/d' pubspec.yaml \
+ && grep -q '^  - halkyon_learn_server$' pubspec.yaml \
+ && ! grep -q -e 'halkyon_learn_client' -e 'halkyon_learn_flutter' \
+      -e 'halkyon_learn_curator' pubspec.yaml
+RUN dart pub get
+WORKDIR /app/halkyon_learn_server
+RUN dart build cli --target bin/main.dart --output build
+RUN mv build/bundle/bin/main build/bundle/bin/server
+RUN mkdir -p config migrations
+
+# ── Runtime stage ─────────────────────────────────────────────────────────────────
+# Ubuntu 24.04: glibc 2.39 (the bundled binaries need at most 2.34, measured) and
+# libgcc_s (needed by libsqlite3_connection_pool, a Rust library; a server running
+# against Postgres never loads it, but a future code path might). CA certificates
+# for outgoing TLS, e.g. GitHub sign-in. git for the published studysets' releases
+# (ADR 0005, rule 3), which the server writes through the git command.
+FROM ubuntu:24.04
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates git \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+
+ENV runmode=production
+ENV serverid=default
+ENV logging=normal
+ENV role=monolith
+
+COPY --from=build /app/halkyon_learn_server/build/bundle/ ./
+COPY --from=build /app/halkyon_learn_server/config/ config/
+COPY --from=build /app/halkyon_learn_server/migrations/ migrations/
+# Mozilla's Public Suffix List, for the Jellyfin server the instance suggests.
+COPY --from=build /app/halkyon_learn_server/data/ data/
+COPY --from=build /app/halkyon_learn_server/lib/src/generated/protocol.yaml lib/src/generated/protocol.yaml
+
+# The server needs no root rights (it listens on 8080 and writes only into the
+# repositories folder), so it runs as an unprivileged system user. The folder is the
+# app user's, and a new volume mounted on it takes that over.
+RUN useradd --system --no-create-home --shell /usr/sbin/nologin app \
+ && mkdir repositories && chown app:app repositories
+USER app
+
+# Only the API server runs in production (no Insights, no web server).
+EXPOSE 8080
+
+# `exec` makes the server PID 1, so it receives Docker's SIGTERM and shuts down
+# cleanly; extra arguments (e.g. --apply-migrations) come from the container command.
+ENTRYPOINT ["/bin/sh", "-c", "exec ./bin/server --mode=$runmode --server-id=$serverid --logging=$logging --role=$role \"$@\"", "--"]
+CMD []