build: one image, nginx in front of the backend on loopback (closes #52)

The root Dockerfile builds the only image; Dockerfile.backend is gone.
Its stages: lint, a Go stage that runs the tests and builds
netwatch-server, the node stage, and an nginx runtime. nginx serves
dist/ on 8080 and proxies /api/ and /.well-known/healthcheck to the
backend on 127.0.0.1:8081. bin/entrypoint.sh starts both, turns TERM or
INT into a stop of both, and exits non-zero when either exits on its
own. The backend runs as user netwatch and keeps reports on the /data
volume. New setting BIND_ADDRESS (empty: every interface). STOPSIGNAL is
SIGTERM, since the nginx image's SIGQUIT would miss the entrypoint.
script/docker is the org model verbatim.

Model: opus-5-5

Dockerfile

@@ -63,8 +63,8 @@ RUN make frontend-check
 FROM nginx@sha256:15e96e59aa3b0aada3a121296e3bce117721f42d88f5f64217ef4b18f458c6ab
 
 # netwatch-server runs as this user, which owns the report directory.
-# nginx keeps the image's own arrangement: its main process runs as
-# root, its worker processes as the nginx user.
+# nginx keeps the image's own arrangement: master process as root,
+# workers as the nginx user.
 RUN addgroup -g 1000 -S netwatch && \
     adduser -u 1000 -S netwatch -G netwatch