build: one image, nginx in front of the backend on loopback (closes #52)

The root Dockerfile builds the only image; Dockerfile.backend is gone.
Its stages: lint, a Go stage that runs the tests and builds
netwatch-server, the node stage, and an nginx runtime. nginx serves
dist/ on 8080 and proxies /api/ and /.well-known/healthcheck to the
backend on 127.0.0.1:8081. bin/entrypoint.sh starts both, turns TERM or
INT into a stop of both, and exits non-zero when either exits on its
own. The backend runs as user netwatch and keeps reports on the /data
volume. New setting BIND_ADDRESS (empty: every interface). STOPSIGNAL is
SIGTERM, since the nginx image's SIGQUIT would miss the entrypoint.
script/docker is the org model verbatim.

Model: opus-5-5

README.md

@@ -44,11 +44,11 @@ halves, so the root `make check` fails if either one is broken. We provide:
   linter in Docker
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
-- `script/projectname` — print the project name (used for the Docker image tags)
+- `script/projectname` — print the project name (used for the Docker image tag)
 - `script/test` — run `script/frontend-test`, then the backend's Go tests, both
   within one 30-second timeout
 - `script/lint` — run `script/frontend-lint`, then golangci-lint in Docker, by
-  building the lint stage of `Dockerfile.backend` without the cache
+  building the lint stage of `Dockerfile` without the cache
 - `script/fmt` — format all files (writes): prettier, then gofmt over `backend/`
 - `script/fmt-check` — check formatting (read-only): prettier, then gofmt
 - `script/check` — run test, lint, and fmt-check
@@ -63,9 +63,9 @@ halves, so the root `make check` fails if either one is broken. We provide:
   frontend in a containerised headless Chrome (see
   [test/viewport/README.md](test/viewport/README.md)). Not part of
   `script/check`: it needs Docker and takes minutes.
-- `script/docker` — build both images, tagged via `script/projectname`:
-  `netwatch` from `Dockerfile` and `netwatch-server` from `Dockerfile.backend`
-- `script/cibuild` — CI entrypoint: builds both images
+- `script/docker` — build the image from `Dockerfile` without the build cache,
+  tagged `netwatch` via `script/projectname`
+- `script/cibuild` — CI entrypoint: builds the image
 - `script/precommit` — run by the git pre-commit hook; runs `script/check`
 - `script/install-precommit` — install the git pre-commit hook
 
@@ -178,13 +178,21 @@ After running `yarn build`, deploy the contents of the `dist/` directory to any
 static file host (S3, GCS, Cloudflare Pages, Vercel, Netlify, GitHub Pages) or
 use the Docker image behind a reverse proxy.
 
-The Docker image:
+The Docker image, built from `Dockerfile`, is the whole service in one
+container: nginx serves the built frontend and passes `/api/` and
+`/.well-known/healthcheck` to the Go backend, `netwatch-server`, which listens
+only inside the container, on `127.0.0.1:8081`. The image:
 
 - Listens on port 8080 by default (override with `PORT` env var)
 - Trusts `X-Forwarded-For` from RFC1918 reverse proxies (10/8, 172.16/12,
   192.168/16)
 - Sends access logs to stdout
 - Caches static assets with immutable headers
+- Stores reports in `DATA_DIR`, `/data/reports` by default, on the `/data`
+  volume. The backend runs as user `netwatch` (uid 1000), so a directory
+  bind-mounted at `/data` must be writable by uid 1000
+- Writes buffered reports to disk on `docker stop`, and exits non-zero if nginx
+  or the backend exits on its own, so the platform restarts it
 
 ## Browser Compatibility