feat(docker): add containerized web build with CORS guidance

Multi-stage Dockerfile (node:22-alpine + pnpm build -> nginx-unprivileged
serve) producing a non-root image that runs under read-only fs + cap_drop
ALL. nginx.conf does SPA-fallback routing, /healthz, immutable asset cache,
and gzip, plus an opt-in same-origin reverse-proxy block.

docs/docker.md documents build/run and the two ways to handle browser CORS
on the web build (configure Honcho's CORSMiddleware, or the nginx proxy).

The Dockerfile and nginx.conf are adapted from @zmarakjanbangash's fork.

Co-authored-by: zmarakjanbangash <zmarakjanbangash@users.noreply.github.com>

docker/nginx.conf

@@ -0,0 +1,54 @@
+# OpenConcho — nginx site config for the runtime container.
+# Serves the React SPA from /usr/share/nginx/html with client-side routing.
+
+server {
+    listen       8080;
+    listen       [::]:8080;
+    server_name  _;
+    root         /usr/share/nginx/html;
+    index        index.html;
+
+    # Don't leak the nginx version.
+    server_tokens off;
+
+    # Long-cache static assets — Vite hashes filenames so they're safely immutable.
+    location ~* \.(?:js|mjs|css|woff2?|ttf|otf|eot|svg|png|jpg|jpeg|gif|ico|webp|avif|wasm)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+        try_files $uri =404;
+    }
+
+    # Healthcheck (no logging spam).
+    location = /healthz {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+
+    # --- Optional: same-origin Honcho reverse proxy (eliminates browser CORS) ---
+    # The SPA's fetches are subject to browser CORS only on the web build (the
+    # desktop app routes through Rust and bypasses CORS). To avoid configuring
+    # CORS on Honcho itself, proxy the API under this origin and point the UI's
+    # base URL at it. See docs/docker.md for the full tradeoff — note the UI
+    # currently requires an absolute base URL, so this block is opt-in.
+    #
+    # location /honcho/ {
+    #     proxy_pass         http://your-honcho-host:8000/;
+    #     proxy_set_header   Host $host;
+    #     proxy_set_header   X-Real-IP $remote_addr;
+    #     proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+    #     proxy_set_header   X-Forwarded-Proto $scheme;
+    # }
+
+    # SPA fallback: any unknown path returns index.html so the router resolves it.
+    location / {
+        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+    }
+
+    # gzip text responses (Vite pre-compresses CSS/JS, but HTML still benefits).
+    gzip on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+    gzip_min_length 1024;
+}