Add self-contained docker/ stack for the web UI

`docker/` now holds the whole web build — frontend (Vite + React + CanvasKit),
backend (Fastify + SQLite) and the compose file — so the folder can be moved to
another machine and run without the React Native project:

    cd docker && cp .env.example .env && docker compose up -d --build

Only `${WEB_PORT:-8090}` is published; nginx serves the SPA and proxies /api to
the `api` container over Docker's DNS. Photos never reach the server.

The shared render code is vendored into `docker/frontend/shared/` and aliased to
a CanvasKit shim, so the app's own frameUtils/toneShader/jpegDpi run unchanged.

Fix the all-black render on GPU surfaces: `MakeWebGLCanvasSurface` creates a
separate WebGL context per call, and a texture from one context cannot be
sampled by a surface on another — so any pass that drew a snapshot onto a second
surface (output sharpen, screen sharpen, polaroid/wallframe cards) came out
solid black, while the raster fallback was correct. Use one shared
GrDirectContext + MakeRenderTarget instead.

Verified in headless Chromium against the running stack: 12MP JPEG in, preview
mean=120.5 sd=60.5, export 2048x1536 mean=107.2 sd=62.1, JFIF density 300/300,
EXIF present, no console errors; health/signup/login/me/recipes all 2xx through
the nginx proxy.

docker/docker-compose.yml

@@ -0,0 +1,26 @@
+# RecipesCam web — the whole stack. Copy this folder anywhere, then:
+#   cp .env.example .env
+#   docker compose up -d --build
+name: recipescam-web
+
+services:
+  # Accounts + saved recipes. Never sees a photo: every pixel of the render
+  # pipeline runs in the visitor's browser.
+  api:
+    build: ./backend
+    restart: unless-stopped
+    environment:
+      DATA_DIR: /data
+    volumes:
+      # SQLite (WAL) lives on the host so a rebuild never loses accounts.
+      - ./data:/data
+
+  # Static SPA + /api reverse proxy. "api" is the DNS name nginx.conf proxies to,
+  # so this service name is load-bearing.
+  frontend:
+    build: ./frontend
+    restart: unless-stopped
+    depends_on:
+      - api
+    ports:
+      - "${WEB_PORT:-8090}:80"