Serve the built SPA from the PHP image; drop the web container

The Dockerfile is now multi-stage: a Node stage runs `npm run build`, and the
PHP/Apache stage copies the result into public/. Apache + public/.htaccess route
/api* to the Slim front controller, serve real files, and fall back to
index.html for client-side routes.

docker-compose.yml loses the `web` service, its volume, and the source
bind-mount -- the image is the artifact now (rebuild to pick up changes).
Frontend dev moves to `npm run dev` on the host; APP_URL defaults to :8080 since
the one container serves both halves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -1,5 +1,19 @@
 # syntax=docker/dockerfile:1
 
+# --- Stage 1: build the Vue frontend ---------------------------------------
+FROM node:24-alpine AS frontend
+
+WORKDIR /web
+
+# Dependencies in their own layer, cached unless the manifests change. npm ci
+# resolves this stage's (musl) platform binaries for rollup/esbuild.
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+
+COPY web/ ./
+RUN npm run build          # vue-tsc type-check, then `vite build` -> /web/dist
+
+# --- Stage 2: PHP + Apache runtime ---------------------------------------------
 FROM php:8.3-apache
 
 # --- PHP extensions and CLI tools ----------------------------------------------
@@ -30,6 +44,9 @@ RUN composer dump-autoload --optimize --no-dev \
     && mkdir -p storage \
     && chown -R www-data:www-data storage
 
+# --- Built frontend: served from the web root next to the API front controller
+COPY --from=frontend /web/dist/ ./public/
+
 # --- Entrypoint: migrate, then hand off to Apache ------------------------
 COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh