Serve the built SPA from the PHP image; drop the web container

The Dockerfile is now multi-stage: a Node stage runs `npm run build`, and the
PHP/Apache stage copies the result into public/. Apache + public/.htaccess route
/api* to the Slim front controller, serve real files, and fall back to
index.html for client-side routes.

docker-compose.yml loses the `web` service, its volume, and the source
bind-mount -- the image is the artifact now (rebuild to pick up changes).
Frontend dev moves to `npm run dev` on the host; APP_URL defaults to :8080 since
the one container serves both halves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -19,9 +19,10 @@ JWT_SECRET=
 # How long an issued token stays valid, in seconds (default: 86400 = 24h).
 JWT_TTL=86400
 
-# Base URL of the frontend. Verification magic links point here, e.g.
-# <APP_URL>/verify-email?token=... (default: http://localhost:5173).
-APP_URL=http://localhost:5173
+# Base URL the app is reached at. Verification magic links point here, e.g.
+# <APP_URL>/verify-email?token=... The Docker image serves the SPA and the API
+# together on http://localhost:8080; a host `npm run dev` serves it on :5173.
+APP_URL=http://localhost:8080
 
 # Email delivery.
 #   mail  — PHP's built-in mail() function (default)