Rebuild the Docker image on Alpine: ~735MB -> ~89MB

Stage 2 was php:8.3-apache (Debian), which compiles PHP from source
with --with-apxs2 for mod_php -- that base image alone is 719MB of
our 735MB, before any app code. Replaced with alpine:3.24 + apk's own
prebuilt php83/php83-apache2/apache2 packages: same architecture (one
process, mod_php, .htaccess-driven rewriting), no fpm/nginx rewrite
needed.

- docker/apache.conf: rewritten for Alpine's apache2 (mod_rewrite ships
  but isn't loaded by default; a different default document root/log
  paths). Logs redirected to stdout/stderr so `docker logs` still shows
  them -- Alpine's own defaults write to a real file under ServerRoot,
  unlike the official Debian image's symlinked paths.
- docker/entrypoint.sh: su-exec instead of su -- BusyBox's su doesn't
  take the same -c/user argument order as the GNU one the previous
  entrypoint relied on. Also moved earlier in the Dockerfile (with the
  other rarely-changing setup, before COPY . .) so it no longer re-runs
  on every build for a file that essentially never changes.
- Composer's binary is still borrowed from the official composer:2
  image via multi-stage COPY, not apk's own `composer` package, which
  turned out to pull in an entire second PHP interpreter (php85) as a
  dependency just to run itself.
- ext-iconv needed adding explicitly (symfony/polyfill-mbstring depends
  on it; the official Debian image bundles it by default, apk doesn't).

Verified against the real compose stack, not just that it builds: apk
install; composer install; migrations on startup; PHPUnit 88/88 (runs
on the host, but confirms nothing else broke); and by hand, all
through the actual container -- health check, SPA fallback for unknown
routes, static assets served directly, the API's 401 guard, and a full
magic-link -> verify -> JWT -> authenticated project create/list round
trip via the real Mailpit catcher.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker/apache.conf

@@ -1,13 +1,23 @@
-<VirtualHost *:80>
-    DocumentRoot /var/www/html/public
+# Alpine's apache2 package ships mod_rewrite but doesn't load it, and defaults
+# to a document root (and log files) that don't match this project -- this
+# file (auto-included via httpd.conf's "IncludeOptional conf.d/*.conf")
+# overrides just those bits, on top of what php83-apache2's own
+# conf.d/php83-module.conf already wired up (LoadModule for mod_php, the
+# .php handler).
+LoadModule rewrite_module modules/mod_rewrite.so
 
-    <Directory /var/www/html/public>
-        Options -Indexes +FollowSymLinks
-        AllowOverride All
-        Require all granted
-        DirectoryIndex index.html index.php
-    </Directory>
+ServerName localhost
+DocumentRoot "/var/www/html/public"
 
-    ErrorLog ${APACHE_LOG_DIR}/error.log
-    CustomLog ${APACHE_LOG_DIR}/access.log combined
-</VirtualHost>
+<Directory "/var/www/html/public">
+    Options -Indexes +FollowSymLinks
+    AllowOverride All
+    Require all granted
+    DirectoryIndex index.html index.php
+</Directory>
+
+# Alpine's own defaults log to a real file under ServerRoot (logs/*.log) --
+# stdout/stderr instead, so `docker logs` shows them, the way the official
+# Debian php:apache image's symlinked log paths used to.
+ErrorLog /dev/stderr
+CustomLog /dev/stdout combined