Add self-contained docker/ stack for the web UI

`docker/` now holds the whole web build — frontend (Vite + React + CanvasKit),
backend (Fastify + SQLite) and the compose file — so the folder can be moved to
another machine and run without the React Native project:

    cd docker && cp .env.example .env && docker compose up -d --build

Only `${WEB_PORT:-8090}` is published; nginx serves the SPA and proxies /api to
the `api` container over Docker's DNS. Photos never reach the server.

The shared render code is vendored into `docker/frontend/shared/` and aliased to
a CanvasKit shim, so the app's own frameUtils/toneShader/jpegDpi run unchanged.

Fix the all-black render on GPU surfaces: `MakeWebGLCanvasSurface` creates a
separate WebGL context per call, and a texture from one context cannot be
sampled by a surface on another — so any pass that drew a snapshot onto a second
surface (output sharpen, screen sharpen, polaroid/wallframe cards) came out
solid black, while the raster fallback was correct. Use one shared
GrDirectContext + MakeRenderTarget instead.

Verified in headless Chromium against the running stack: 12MP JPEG in, preview
mean=120.5 sd=60.5, export 2048x1536 mean=107.2 sd=62.1, JFIF density 300/300,
EXIF present, no console errors; health/signup/login/me/recipes all 2xx through
the nginx proxy.

docker/frontend/src/api.ts

@@ -0,0 +1,45 @@
+// Thin wrapper over the API container. Same origin in production (nginx proxies
+// /api), the Vite dev server proxies it too — so no base URL, no CORS.
+import type { Recipe } from '../shared/types';
+
+export interface User {
+  id: number;
+  email: string;
+}
+
+export interface SavedRecipe {
+  id: number;
+  name: string;
+  recipe: unknown;
+  createdAt: string;
+  updatedAt: string;
+}
+
+async function call<T>(path: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(`/api${path}`, {
+    credentials: 'same-origin',
+    headers: init?.body ? { 'content-type': 'application/json' } : undefined,
+    ...init,
+  });
+  if (res.status === 204) return undefined as T;
+  const text = await res.text();
+  const body = text ? JSON.parse(text) : {};
+  if (!res.ok) throw new Error(body.error ?? `HTTP ${res.status}`);
+  return body as T;
+}
+
+export const api = {
+  me: () => call<{ user: User }>('/auth/me'),
+  signup: (email: string, password: string) =>
+    call<{ user: User }>('/auth/signup', { method: 'POST', body: JSON.stringify({ email, password }) }),
+  login: (email: string, password: string) =>
+    call<{ user: User }>('/auth/login', { method: 'POST', body: JSON.stringify({ email, password }) }),
+  logout: () => call<void>('/auth/logout', { method: 'POST' }),
+
+  listRecipes: () => call<{ recipes: SavedRecipe[] }>('/recipes'),
+  createRecipe: (name: string, recipe: Recipe) =>
+    call<{ recipe: SavedRecipe }>('/recipes', { method: 'POST', body: JSON.stringify({ name, recipe }) }),
+  updateRecipe: (id: number, name: string, recipe: Recipe) =>
+    call<{ recipe: SavedRecipe }>(`/recipes/${id}`, { method: 'PUT', body: JSON.stringify({ name, recipe }) }),
+  deleteRecipe: (id: number) => call<void>(`/recipes/${id}`, { method: 'DELETE' }),
+};