Add Docker support for headless network discovery

[asachs01]

Summary

• Adds docker/ directory with Dockerfile, docker-compose.yml, entrypoint, and discovery runner
• Installs SC2 with --no-deps to skip PyQt6 (~200MB savings), explicitly lists headless runtime deps
• Uses library APIs directly (CredentialVault, DiscoveryEngine) to bypass interactive getpass() prompts
• Credentials injected via environment variables (SNMPv2c, SNMPv3, SSH)
• Runs as non-root user with tini for signal handling and resource limits
• Adds "Docker (Headless)" section to README with env var reference

Motivation

Several users have asked about running SC2 in headless/scheduled environments (cron jobs, CI pipelines, remote servers without X11). This PR provides a production-ready Docker deployment that handles the main pain points:

1. PyQt6 dependency — not needed for headless runs, adds ~200MB
2. Interactive getpass() — sc2-creds init and sc2-discover prompt for passwords, which fails in non-interactive contexts
3. System dependencies — SNMP tools, graphviz, and MIBs require manual installation

What's included

File	Purpose
docker/Dockerfile	Python 3.12-slim, SNMP tools, graphviz, tini, non-root user
docker/docker-compose.yml	Service definition with vault volume, env vars, resource limits
docker/.env.template	Environment variable reference
docker/entrypoint.sh	Signal handling wrapper
docker/discovery_runner.py	Headless runner using SC2 library APIs
docker/.gitignore	Excludes .env and output/

Test plan

• cd docker && docker compose build completes without errors
• docker compose up with valid .env runs discovery against test network
• Container shows proper error when SC_SEED_IP or SC_VAULT_PASSWORD not set
• Output files (map.json, devices.csv, topology.graphml) appear in docker/output/
• Credential vault persists between runs (stop/start container)
• docker compose run sc2 bash provides interactive shell for debugging