build: multi-stage Dockerfile (node build -> go embed -> distroless)

Three-stage image: node:22-alpine builds the Vite SPA, golang:1.26.4-alpine
compiles the server with the built SPA copied into the //go:embed path
before build, distroless/static-debian12:nonroot runs the static binary
as non-root on :8080. .dockerignore keeps node_modules/dist/docs/git out
of the build context while preserving the internal/web/dist/index.html
placeholder needed for a valid embed target pre-COPY.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

.dockerignore

@@ -0,0 +1,9 @@
+.git
+.superpowers
+docs
+web/node_modules
+web/dist
+internal/web/dist/assets
+swarm-report
+*.md
+.env