build: one image, nginx in front of the backend on loopback (closes #52)

The root Dockerfile builds the only image; Dockerfile.backend is gone.
Its stages: lint, a Go stage that runs the tests and builds
netwatch-server, the node stage, and an nginx runtime. nginx serves
dist/ on 8080 and proxies /api/ and /.well-known/healthcheck to the
backend on 127.0.0.1:8081. bin/entrypoint.sh starts both, turns TERM or
INT into a stop of both, and exits non-zero when either exits on its
own. The backend runs as user netwatch and keeps reports on the /data
volume. New setting BIND_ADDRESS (empty: every interface). STOPSIGNAL is
SIGTERM, since the nginx image's SIGQUIT would miss the entrypoint.
script/docker is the org model verbatim.

Model: opus-5-5

backend/script/build

@@ -8,7 +8,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
     cd "$ROOT"
 
-    # VERSION comes from the environment (Dockerfile.backend passes its
+    # VERSION comes from the environment (the root Dockerfile passes its
     # ARG VERSION in). Unset or empty, it is git describe, or "dev" where
     # there is no git or no repository history.
     version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"

backend/script/lint

@@ -1,6 +1,6 @@
 #!/bin/sh
 # script/lint: run golangci-lint over the backend. This runs inside the
-# lint stage of Dockerfile.backend, whose digest-pinned golangci-lint
+# lint stage of the root Dockerfile, whose digest-pinned golangci-lint
 # image provides the linter; nothing installs golangci-lint on the host.
 # From a checkout, run `make lint` at the repo root, which builds that
 # stage.