Bind-mount the project into the container for live edits

docker-compose.yml now mounts the working directory at /var/www/html so
PHP changes take effect without an image rebuild. To avoid a mount nested
inside that bind mount, the storage directory moves out to /var/www/storage
(still a named volume). Config gains a STORAGE_PATH env var driving both the
SQLite database and the JWT signing-key location; the entrypoint chowns that
directory. The Dockerfile is unchanged and still builds a self-contained
image (STORAGE_PATH defaults back to ./storage when unset).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -22,9 +22,15 @@ docker compose up -d
 This builds a PHP 8.3 + Apache image, applies migrations, and serves the API at
 <http://localhost:8080> (e.g. `curl http://localhost:8080/api/health`).
 
+- The project directory is bind-mounted into the container, so editing PHP
+  source takes effect without a rebuild (within ~2s, due to the opcache
+  revalidation interval). `vendor/` is used from the host — run `composer`
+  once first if it is missing (see "Run without Docker" below, or
+  `docker compose run --rm --entrypoint composer app install`).
 - The SQLite database and the generated JWT signing key live in the `storage`
-  named volume, so they survive `docker compose restart` / `down` + `up`.
-- After changing PHP source or `composer.json`, rebuild: `docker compose up -d --build`.
+  named volume, mounted at `/var/www/storage` (outside the bind-mounted source),
+  so they survive `docker compose restart` / `down` + `up`.
+- Rebuild only after changing the `Dockerfile`: `docker compose up -d --build`.
 - `docker compose down -v` removes the volume and gives you a clean database.
 - Override settings via the environment or a `.env` file in this directory
   (Compose substitutes `APP_DEBUG`, `JWT_SECRET`, `JWT_TTL` — see