feat(cmd): add a standalone gateway binary and container image

cmd/gateway runs the middleware as its own HTTP server behind Traefik.
It reads a YAML config, converts it to JSON and decodes it with
DisallowUnknownFields, so a misspelled key stops startup. It warns
when metrics.allowedCIDRs is set, because behind a proxy the source
address is the proxy's.

The Makefile gains build-binary, docker-build and run-local targets.
The Dockerfile builds from the committed vendor tree and stamps
main.version from the VERSION build argument. go.mod lists
go.yaml.in/yaml/v3 as a direct dependency.

Claude-Session: https://claude.ai/code/session_01V5jYJNxpDFdJkyyExpADrv

.gitignore

@@ -8,6 +8,11 @@ tools/yaegi-check/llmgw-yaegi-check
 tools/pricing-sync/llmgw-pricing-sync
 dist/
 
+# `make build-binary`'s output — the standalone binary (deployment form B,
+# see README's "Deployment modes"). Built locally on demand, never
+# committed, exactly like the two tool binaries above.
+bin/
+
 # webui/'s build output (dist/, matched above) and npm dependency tree —
 # neither is source: dist/ is regenerated by `vite build`, node_modules/ by
 # `npm ci`. admin_assets_gen.go (repo root, `make admin-ui`'s other output)