feat(docker): add self-hosted all-in-one container setup

- Add Dockerfile (multi-stage build, unprivileged user, healthcheck),
  docker-compose.yml and .dockerignore
- Server now serves static dist/ frontend and WebSocket relay on a
  single port (PORT, default 3001) with path-traversal protection,
  immutable asset caching and SPA fallback
- Client connects via same origin in production; dedicated ws port is
  only used for vite dev/preview
- Document Docker usage, env vars and manual production mode in README

.dockerignore

@@ -0,0 +1,19 @@
+node_modules
+dist
+.git
+.gitignore
+.dockerignore
+Dockerfile
+docker-compose.yml
+*.log
+npm-debug.log*
+public/shot*.png
+test-results
+coverage
+.vscode
+.idea
+.DS_Store
+.env
+.env.*
+README.md
+scripts