Bind-mount the project into the container for live edits

docker-compose.yml now mounts the working directory at /var/www/html so
PHP changes take effect without an image rebuild. To avoid a mount nested
inside that bind mount, the storage directory moves out to /var/www/storage
(still a named volume). Config gains a STORAGE_PATH env var driving both the
SQLite database and the JWT signing-key location; the entrypoint chowns that
directory. The Dockerfile is unchanged and still builds a self-contained
image (STORAGE_PATH defaults back to ./storage when unset).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -4,7 +4,13 @@
 # Show full exception details in API error responses. Never enable in production.
 APP_DEBUG=false
 
+# Directory for generated files: the SQLite database and the JWT signing key.
+# Defaults to <project>/storage. The Docker setup points this at a volume
+# outside the bind-mounted source.
+STORAGE_PATH=storage
+
 # Path to the SQLite database file (absolute, or relative to the project root).
+# Defaults to <STORAGE_PATH>/database.sqlite.
 DATABASE_PATH=storage/database.sqlite
 
 # Secret used to sign JWTs. Leave blank to auto-generate one into storage/secret.key.