feat(docker): add containerized web build with CORS guidance

Multi-stage Dockerfile (node:22-alpine + pnpm build -> nginx-unprivileged
serve) producing a non-root image that runs under read-only fs + cap_drop
ALL. nginx.conf does SPA-fallback routing, /healthz, immutable asset cache,
and gzip, plus an opt-in same-origin reverse-proxy block.

docs/docker.md documents build/run and the two ways to handle browser CORS
on the web build (configure Honcho's CORSMiddleware, or the nginx proxy).

The Dockerfile and nginx.conf are adapted from @zmarakjanbangash's fork.

Co-authored-by: zmarakjanbangash <zmarakjanbangash@users.noreply.github.com>

.dockerignore

@@ -0,0 +1,12 @@
+**/node_modules
+**/dist
+**/target
+**/.turbo
+**/.vite
+.git
+.github
+packages/desktop/src-tauri/target
+e2e
+playwright-report
+test-results
+*.log