Serve the built SPA from the PHP image; drop the web container

The Dockerfile is now multi-stage: a Node stage runs `npm run build`, and the
PHP/Apache stage copies the result into public/. Apache + public/.htaccess route
/api* to the Slim front controller, serve real files, and fall back to
index.html for client-side routes.

docker-compose.yml loses the `web` service, its volume, and the source
bind-mount -- the image is the artifact now (rebuild to pick up changes).
Frontend dev moves to `npm run dev` on the host; APP_URL defaults to :8080 since
the one container serves both halves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -8,14 +8,14 @@ services:
       - "8080:80"
     environment:
       APP_DEBUG: "${APP_DEBUG:-false}"
-      # Generated files (SQLite DB + JWT signing key) go here, on their own
-      # volume so they don't overlap the bind mount below.
+      # Generated files (SQLite DB + JWT signing key) go here, on the `storage`
+      # volume below.
       STORAGE_PATH: /var/www/storage
       # Leave blank to auto-generate a secret into the storage volume on first run.
       JWT_SECRET: "${JWT_SECRET:-}"
       JWT_TTL: "${JWT_TTL:-86400}"
-      # Magic links point at the frontend dev server.
-      APP_URL: "${APP_URL:-http://localhost:5173}"
+      # The SPA and the API are both served from this container.
+      APP_URL: "${APP_URL:-http://localhost:8080}"
       # Deliver to the Mailpit catcher below; read mail at http://localhost:8025.
       MAIL_TRANSPORT: "${MAIL_TRANSPORT:-smtp}"
       MAIL_FROM: "${MAIL_FROM:-no-reply@todo.test}"
@@ -25,9 +25,9 @@ services:
       MAIL_SMTP_PASSWORD: "${MAIL_SMTP_PASSWORD:-}"
       MAIL_SMTP_ENCRYPTION: "${MAIL_SMTP_ENCRYPTION:-none}"
     volumes:
-      # Live source: edit on the host, no image rebuild needed.
-      - .:/var/www/html
-      # Persistent storage, kept outside /var/www/html to avoid a nested mount.
+      # Only generated state is mounted. The app itself — PHP source and the
+      # built frontend — is baked into the image; rebuild to pick up changes:
+      #   docker compose up -d --build
       - storage:/var/www/storage
     depends_on:
       - mailpit
@@ -42,25 +42,5 @@ services:
       - "1025:1025"   # SMTP (also reachable in-network as mailpit:1025)
     restart: unless-stopped
 
-  # Optional Vite dev server. Start it with:  docker compose --profile frontend up -d
-  # Without the profile, `docker compose up -d` runs the API alone.
-  web:
-    build: ./web
-    image: php-project-manager-web
-    profiles: ["frontend"]
-    ports:
-      - "5173:5173"
-    environment:
-      # /api is proxied to the API container on the compose network.
-      VITE_PROXY_TARGET: "http://app:80"
-    volumes:
-      - ./web:/app
-      # Keep the image's platform-specific node_modules; don't let the host's shadow them.
-      - web_node_modules:/app/node_modules
-    depends_on:
-      - app
-    restart: unless-stopped
-
 volumes:
   storage:
-  web_node_modules: