Add a log view, and Docker packaging

The Log button shows the running daemon live: feed scans, downloads,
torrents and every HTTP request. It reads a ring buffer filled by a
tracing layer rather than tailing a file, so it works under Docker where
logs go to stdout. The access-log middleware skips /api/logs, or the
panel's poll would log itself forever.

Detached torrents could leave a row stuck in 'downloading' across a
restart, where nothing would ever revisit it; those are requeued at
startup.

Dockerfile, entrypoint and compose: 114 MB runtime, config bound to
0.0.0.0 on first run since container loopback is unreachable, drops to
PUID:PGID for Unraid, and a healthcheck that goes through the control
socket so a wedged worker reads as unhealthy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdXho5tTkjFLeUXKbEjKBh

README.md

@@ -134,6 +134,30 @@ server-side before they reach the page.
 clear — and a feed URL can itself contain a credential (Patreon's, for one, carries an auth token).
 Put it behind a reverse proxy with TLS if that matters to you.
 
+## Log view
+
+The **Log** button in the sidebar shows the running daemon's output live: feed scans, downloads,
+torrent activity and every HTTP request, with level and text filters and a copy button. It reads a
+2000-line ring buffer held inside the process (`/api/logs`), not a file — so it works the same under
+Docker, where logs go to stdout and there is no file to tail. `IPX_LOG=ipx=debug` adds detail;
+`IPX_LOG=ipx=info,librqbit=info` shows what torrents are doing.
+
+## Docker
+
+```sh
+docker compose up -d          # builds the image and starts it
+docker compose logs -f ipx    # the token is printed on first start
+```
+
+`docker-compose.yml` mounts `./config`, `./data` and a downloads directory, publishes 8099 for the
+UI and 6881 (TCP **and** UDP — DHT needs the UDP side), and sets `PUID`/`PGID` to `99:100` so files
+land owned the way Unraid shares expect. On first start the entrypoint writes a config bound to
+`0.0.0.0`, since a container's loopback is not reachable from outside it, and prints the URL with
+its generated token.
+
+The healthcheck runs `ipx status`, which goes through the control socket to the command worker — so
+it catches a daemon that is alive but wedged, not merely one that has died.
+
 ## Running it as a service
 
 `contrib/` has a systemd user unit for the daemon, and a timer plus one-shot service if you would