chore: Refactor Docker setup — single multi-stage Dockerfile + AIO image

[everythings-gonna-be-alright]

Summary

Consolidates the Docker setup from a fragmented multi-file layout into a clean, security-hardened structure under docker/.

What changed

Dockerfile (Dockerfile → docker/Dockerfile)

• Moved to docker/ and restructured as a proper multi-stage build:
  • vendor — Composer deps via composer:2.9.8 image
  • frontend — Node 24 + Vite build via node:24.15.0-alpine3.23
  • base — php:8.5.5-fpm-alpine3.23 runtime only (no nginx/supervisor)
  • aio — All-in-one target: adds nginx + supervisord into a single image for zero-dependency deployments (e.g. docker run -p 80:80)
• Dedicated non-root user chadmin (UID 1984) owns the app files and runs PHP-FPM
• Old Dockerfile at root deleted
  Configs (docker/configs/)
• nginx.conf — main nginx config extracted from legacy docker/prod/nginx.conf
• nginx-chadmin.conf — vhost config (was nested under docker/dev/nginx/)
• php-fpm.conf — pool config (was docker/prod/php-fpm.conf)
• supervisord.conf — manages nginx + php-fpm processes inside the aio target
  Entrypoint (docker/aio-entrypoint.sh)
• Renamed from docker/entrypoint.sh
• Generates a random APP_SECRET fallback if not set, preventing container crash on first run without full env config
  docker-compose.yml
• Replaces heavyweight custom nginx + php Dockerfiles with:
  • nginxinc/nginx-unprivileged:1.31.0-alpine3.23-slim — rootless nginx out of the box
  • docker/Dockerfile base target for PHP-FPM
  • Official composer:latest and node:24.15.0-alpine3.23 images for deps
• Unix socket (php-sock volume) for nginx ↔ PHP-FPM communication instead of TCP
  Deleted
• docker/dev/nginx/Dockerfile, docker/dev/php/Dockerfile — replaced by official images
• docker/prod/nginx.conf, php-fpm.conf, php.ini, supervisord.conf — consolidated into docker/configs/

Why

Before	After
3 separate Dockerfiles	1 multi-stage Dockerfile with named targets
nginx ran as root	rootless nginx-unprivileged (UID 1984)
Scattered prod configs	All configs under docker/configs/
No single-container option	aio target: one image, one docker run
dev/prod config duplication	Single config set reused across compose + aio

Testing

# Dev (compose)
docker-compose up -d
open http://localhost
# AIO single container
docker build --target aio -t chadmin:aio -f docker/Dockerfile .
docker run -p 80:80 --env-file .env chadmin:aio
open http://localhost