Add self-contained docker/ stack for the web UI

`docker/` now holds the whole web build — frontend (Vite + React + CanvasKit),
backend (Fastify + SQLite) and the compose file — so the folder can be moved to
another machine and run without the React Native project:

    cd docker && cp .env.example .env && docker compose up -d --build

Only `${WEB_PORT:-8090}` is published; nginx serves the SPA and proxies /api to
the `api` container over Docker's DNS. Photos never reach the server.

The shared render code is vendored into `docker/frontend/shared/` and aliased to
a CanvasKit shim, so the app's own frameUtils/toneShader/jpegDpi run unchanged.

Fix the all-black render on GPU surfaces: `MakeWebGLCanvasSurface` creates a
separate WebGL context per call, and a texture from one context cannot be
sampled by a surface on another — so any pass that drew a snapshot onto a second
surface (output sharpen, screen sharpen, polaroid/wallframe cards) came out
solid black, while the raster fallback was correct. Use one shared
GrDirectContext + MakeRenderTarget instead.

Verified in headless Chromium against the running stack: 12MP JPEG in, preview
mean=120.5 sd=60.5, export 2048x1536 mean=107.2 sd=62.1, JFIF density 300/300,
EXIF present, no console errors; health/signup/login/me/recipes all 2xx through
the nginx proxy.

docker/frontend/src/main.tsx

@@ -0,0 +1,21 @@
+import { createRoot } from 'react-dom/client';
+import './styles/tokens.css';
+import './styles/app.css';
+import { ThemeProvider } from './theme/ThemeProvider';
+import { I18nProvider } from './i18n/I18nProvider';
+import { Landing } from './Landing';
+import { Workspace } from './App';
+
+// Two routes, no router: the landing page and the workspace. nginx serves
+// index.html for both (SPA fallback), so this is just a pathname check.
+const isWorkspace = window.location.pathname.startsWith('/app');
+const root = document.getElementById('root');
+if (!root) throw new Error('#root missing');
+
+// No StrictMode: it double-invokes effects, which would load CanvasKit twice and
+// run the render pipeline twice on every mount.
+createRoot(root).render(
+  <ThemeProvider>
+    <I18nProvider>{isWorkspace ? <Workspace /> : <Landing />}</I18nProvider>
+  </ThemeProvider>
+);