feat(docker): add self-hosted all-in-one container setup

- Add Dockerfile (multi-stage build, unprivileged user, healthcheck),
  docker-compose.yml and .dockerignore
- Server now serves static dist/ frontend and WebSocket relay on a
  single port (PORT, default 3001) with path-traversal protection,
  immutable asset caching and SPA fallback
- Client connects via same origin in production; dedicated ws port is
  only used for vite dev/preview
- Document Docker usage, env vars and manual production mode in README

src/game/net.ts

@@ -33,9 +33,16 @@ export interface NetHandlers {
 
 export function serverUrl(): string {
   if (typeof location === 'undefined') return 'ws://localhost:3001'
+  // explicit override, e.g. ?server=ws://192.168.1.10:3001
   const custom = new URLSearchParams(location.search).get('server')
   if (custom) return custom
-  return `ws://${location.hostname}:3001`
+  // vite dev/preview servers run the ws relay on a separate port
+  if (location.port === '5173' || location.port === '4173') {
+    return `ws://${location.hostname}:3001`
+  }
+  // production (Docker / node server): frontend and ws share one origin
+  const proto = location.protocol === 'https:' ? 'wss' : 'ws'
+  return `${proto}://${location.host}`
 }
 
 /** Thin WebSocket wrapper for the TRXTD room/action protocol. */