Bind-mount the project into the container for live edits

docker-compose.yml now mounts the working directory at /var/www/html so
PHP changes take effect without an image rebuild. To avoid a mount nested
inside that bind mount, the storage directory moves out to /var/www/storage
(still a named volume). Config gains a STORAGE_PATH env var driving both the
SQLite database and the JWT signing-key location; the entrypoint chowns that
directory. The Dockerfile is unchanged and still builds a self-contained
image (STORAGE_PATH defaults back to ./storage when unset).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -6,12 +6,17 @@ services:
       - "8080:80"
     environment:
       APP_DEBUG: "${APP_DEBUG:-false}"
+      # Generated files (SQLite DB + JWT signing key) go here, on their own
+      # volume so they don't overlap the bind mount below.
+      STORAGE_PATH: /var/www/storage
       # Leave blank to auto-generate a secret into the storage volume on first run.
       JWT_SECRET: "${JWT_SECRET:-}"
       JWT_TTL: "${JWT_TTL:-86400}"
     volumes:
-      # Persists the SQLite database and the generated signing key across restarts.
-      - storage:/var/www/html/storage
+      # Live source: edit on the host, no image rebuild needed.
+      - .:/var/www/html
+      # Persistent storage, kept outside /var/www/html to avoid a nested mount.
+      - storage:/var/www/storage
     restart: unless-stopped
 
 volumes: