Track five things a day for seventy-five days

The workout, the protein, the calories, the water, and three lines of
gratitude. One page per day, a card of seventy-five tiles that fill by
how many of the five landed, and a missed day left as a gap rather than
a reset.

Single Go binary with no dependencies. The log is one JSON file on a
mounted volume, written atomically and never silently replaced when it
fails to parse, since it is the one thing here that cannot be recreated.
Auth is Traefik basic auth at the ingress; the app has no login of its
own, so every POST checks Sec-Fetch-Site to stop another origin posting
with those credentials.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,28 @@
+FROM golang:1.26-alpine AS build
+
+WORKDIR /src
+
+# Dependencies first, so edits to the app don't re-download the module cache.
+# There are none, but the layer keeps the shape of the other apps.
+COPY go.mod ./
+RUN go mod download
+
+COPY . .
+
+# Static binary: no libc, so it runs in a scratch image. The timezone database
+# is embedded by the `time/tzdata` import in main.go.
+RUN CGO_ENABLED=0 GOOS=linux go build \
+        -trimpath \
+        -ldflags="-s -w" \
+        -o /out/tracker ./cmd/server
+
+
+FROM scratch
+
+COPY --from=build /out/tracker /tracker
+
+# nobody:nogroup — the only writable path is the mounted volume at /data.
+USER 65534:65534
+
+EXPOSE 8080
+ENTRYPOINT ["/tracker"]