professionalize repo for public release

- rename ctcloud -> bucketeer everywhere (cmd/bucketeer, binary, compose service)
- group brand assets under assets/ (light/dark logo + UI screenshot)
- move long-form docs under docs/ (ARCHITECTURE, DESIGN, GOAL) and add
  docs/SKILL.md: how an agent queries/audits a running instance and answers
  user questions from the API and PostgreSQL
- README: large logo (light/dark picture) and UI screenshot, repository layout
- .gitignore: /bucketeer, .env, pgdata, build/test artifacts, OS junk
- .dockerignore: keep brand/docs/markdown out of the build context

docker-compose.yml

@@ -3,7 +3,7 @@
 # Secrets come from .env (gitignored). Copy .env.example to .env and set a
 # strong POSTGRES_PASSWORD plus a matching DATABASE_URL before `docker compose
 # up`. For a production database, point DATABASE_URL at a TLS-enabled endpoint,
-# e.g. postgres://user:[email protected]:5432/ctcloud?sslmode=verify-full
+# e.g. postgres://user:[email protected]:5432/bucketeer?sslmode=verify-full
 #
 # The compose bridge network is private; sslmode=disable is only acceptable here
 # because the database is not reachable from outside the stack.
@@ -11,13 +11,13 @@ services:
   postgres:
     image: postgres:17-alpine
     environment:
-      POSTGRES_USER: ${POSTGRES_USER:-ctcloud}
+      POSTGRES_USER: ${POSTGRES_USER:-bucketeer}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
-      POSTGRES_DB: ${POSTGRES_DB:-ctcloud}
+      POSTGRES_DB: ${POSTGRES_DB:-bucketeer}
     volumes:
       - pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-ctcloud} -d ${POSTGRES_DB:-ctcloud}"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-bucketeer} -d ${POSTGRES_DB:-bucketeer}"]
       interval: 5s
       timeout: 5s
       retries: 12
@@ -29,13 +29,13 @@ services:
       options: { max-size: "10m", max-file: "3" }
     restart: unless-stopped
 
-  ctcloud:
+  bucketeer:
     build: .
     depends_on:
       postgres:
         condition: service_healthy
-    # All optional tuning (DNS_SERVERS, PROBE_*, UI_USER, ...) comes from .env.
-    # Leave DNS_SERVERS unset to use the curated + community resolver list.
+    # All optional tuning (DNS_SERVERS, PROBE_*, BUCKET_SCAN_*, UI_USER, ...)
+    # comes from .env. Leave DNS_SERVERS unset to use the curated resolvers.
     env_file:
       - .env
     environment: