SPA is vanilla JS shipped as static files in web/dist/, no npm build step required.
Replace @latest with @v2.1.6 to comply with hash-pinning policy defined in REPO_POLICIES.md.
Multi-stage build: golang:1.24-alpine builder, alpine:3.21 runtime. Verified locally: all fx modules instantiate, migrations run, healthcheck responds at /.well-known/healthcheck.json.