feat: single container image (nginx + backend), fix fresh DB init

- deploy/Dockerfile: unified image with supervisord (nginx + uvicorn)
- distribution/docker-compose.single.yml: single container option
- distribution/README.md: 3 deployment options (single, compose, docker run)
- Fix: add status column to chat_messages CREATE TABLE (was only in migration, broke fresh DB)
- push-images.sh: builds 3 images (unified, backend, frontend)

distribution/README.md

@@ -117,7 +117,7 @@ APP_SECRET=<generate with: openssl rand -hex 64>
 ### 2. Login to OCIR
 
 ```bash
-docker login ${OCIR_REGION}.ocir.io
+docker login <OCIR_REGION>.ocir.io
 ```
 
 - **Username:** `<namespace>/<username>` or `<namespace>/oracleidentitycloudservice/<email>`
@@ -125,17 +125,45 @@ docker login ${OCIR_REGION}.ocir.io
 
 ### 3. Run
 
+**Option A — Single Container** (recommended for simplicity):
+
+```bash
+docker compose -f docker-compose.single.yml up -d
+```
+
+One container runs everything (nginx + backend). Port `8080`.
+
+**Option B — Two Containers** (recommended for production):
+
 ```bash
 docker compose up -d
 ```
 
+Separate backend and frontend containers with internal networking.
+
+**Option C — Docker Run** (no compose needed):
+
+```bash
+docker run -d \
+  --name oci-cis-agent \
+  -p 8080:8080 \
+  -v agent-data:/data \
+  -e APP_SECRET=$(openssl rand -hex 64) \
+  -e TZ=America/Sao_Paulo \
+  <OCIR_REGION>.ocir.io/<OCIR_NAMESPACE>/oci-cis-agent:latest
+```
+
 ### 4. Access
 
 Open `http://localhost:8080`
 
-The initial admin password is generated automatically and displayed in the backend logs:
+The initial admin password is generated automatically and displayed in the container logs:
 
 ```bash
+# Single container / docker run
+docker logs oci-cis-agent | grep "password"
+
+# Two containers
 docker compose logs backend | grep "password"
 ```