Serve the built SPA from the PHP image; drop the web container

The Dockerfile is now multi-stage: a Node stage runs `npm run build`, and the
PHP/Apache stage copies the result into public/. Apache + public/.htaccess route
/api* to the Slim front controller, serve real files, and fall back to
index.html for client-side routes.

docker-compose.yml loses the `web` service, its volume, and the source
bind-mount -- the image is the artifact now (rebuild to pick up changes).
Frontend dev moves to `npm run dev` on the host; APP_URL defaults to :8080 since
the one container serves both halves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

public/.htaccess

@@ -1,4 +1,17 @@
-# Route every request that isn't a real file through the front controller.
+# The built Vue SPA is served from this directory (baked into the Docker image);
+# the Slim front controller handles the API. Anything that isn't a real file is
+# a client-side route and falls back to index.html.
 RewriteEngine On
-RewriteCond %{REQUEST_FILENAME} !-f
-RewriteRule ^ index.php [QSA,L]
+
+# API: hand off to the front controller.
+RewriteRule ^api(/|$) index.php [QSA,L]
+
+# Real files (hashed assets, favicon, manifest, service worker): serve directly.
+RewriteCond %{REQUEST_FILENAME} -f
+RewriteRule ^ - [L]
+
+# SPA fallback when a build is present; otherwise the API front controller
+# (e.g. `composer serve` with no frontend built).
+RewriteCond %{DOCUMENT_ROOT}/index.html -f
+RewriteRule ^ index.html [L]
+RewriteRule ^ index.php [L]