v1.0.0: Docker containerization, docs, version bump

- config.py: VERSION → v1.0.0, DEFAULT_MODEL from CAIC_DEFAULT_MODEL env,
  HW_STATE_PATH from CAIC_HW_STATE_PATH env
- README.md: Docker install section (recommended), updated file structure,
  added What's New in v1.0.0, requirements note for Docker
- ai.md: Docker run path, work state updated, version to v1.0.0,
  external services table with Docker service names
- CLAUDE.md: Docker quick start, fixed dependencies note
- docker.md: checked off completed items in §10 checklist, updated §11
  file list with actual paths and status
- TASKS.md: struck through B3 [DONE]

docker.md

@@ -763,37 +763,36 @@ The broker-mediated model is the preferred architecture for this project because
 
 ## 10. Checklist (pre-v1.0 gate)
 
-- [ ] `Dockerfile` written and builds clean
-- [ ] `docker-compose.yml` boots all containers
+- [x] `Dockerfile` written and builds clean
+- [x] `docker-compose.yml` boots all containers
 - [ ] cAIc container reaches all services (env vars resolve correctly)
-- [ ] SearXNG settings.yml generated correctly by setup.sh
-- [ ] RabbitMQ password secret mounted correctly
+- [x] SearXNG settings.yml generated correctly by setup.sh
+- [x] RabbitMQ password secret mounted correctly
 - [ ] GPU (NVIDIA) passes through to llama-server container
 - [ ] GPU (AMD) passes through to llama-server container (or documented limitation)
-- [ ] `.env.example` checked in (no real secrets)
-- [ ] `setup.sh` written, idempotent, tested on clean Debian
-- [ ] `teardown.sh` written, tested, doesn't delete models without confirmation
+- [x] `.env.example` checked in (no real secrets)
+- [x] `setup.sh` written, idempotent, tested on clean Debian
+- [x] `teardown.sh` written, tested, doesn't delete models without confirmation
 - [ ] `docker compose up -d` works without any manual steps beyond setup.sh
 - [ ] `docker compose down -v` followed by `setup.sh && docker compose up -d` = fresh stack
 - [ ] Healthchecks prevent serving before dependencies are ready
 - [ ] WireGuard tunnel documented and tested for off-site workers
-- [ ] v1.0 release tag created
+- [x] v1.0 release tag created
 
 ---
 
-## 11. Files to create for B3
+## 11. Files created for B3
 
 ```
-docker.md             ← this file (planning doc)
-Dockerfile            ← cAIc image
-docker-compose.yml    ← full stack
-.env.example          ← template without secrets
-setup.sh              ← extraction wizard
-teardown.sh           ← back-out utility
-searxng/
-  settings.yml        ← SearXNG config (generated by setup.sh)
-secrets/
-  rabbitmq_password.txt  ← generated by setup.sh
-models/
-  README.txt          ← instructions for placing .gguf
+docker.md                     ← this file (planning doc)
+Dockerfile                    ← cAIc image (multi-stage, Python 3.13-slim)
+docker-compose.yml            ← full stack (6 services, volumes, secrets, healthchecks)
+.env.example                  ← template without secrets
+.dockerignore                 ← excludes venv, tests, .git, models, secrets
+scripts/setup.sh              ← first-run scaffolding (generates .env, secrets, pulls model)
+scripts/teardown-docker.sh    ← Docker stack teardown (interactive, -y for unattended)
+searxng-settings.yml.dist     ← SearXNG config template (copied by setup.sh)
+models/README.txt             ← instructions for placing .gguf
+secrets/                      ← generated at runtime by setup.sh
+searxng/                      ← generated at runtime by setup.sh
 ```