feat(web): package the sandbox dashboard as a static nginx container

[tiana-code]

E-08 Sandbox UI #290 (F-08.10) - container packaging for the dashboard.

What

• web/Dockerfile - multi-stage: node:22-alpine builds the bundle, nginxinc/nginx-unprivileged:1.27-alpine serves it (non-root uid 101, port 8080). SPDX header.
• web/default.conf - SPA fallback (try_files), server_tokens off, gzip on text assets, Cache-Control no-cache on index.html + immutable on fingerprinted assets.
• web/.dockerignore - excludes node_modules/dist/.git/.env (keeps package-lock + src).
• web-ci.yml - new docker job: builds the image (context web, no push), hard-asserts non-root, smoke-runs and curls / + a client route /payments (SPA fallback), Trivy CRITICAL scan with the DB mirror. No deploy.
• docker-compose.yml - web service (build ./web, 8082:8080, avoids the grafana 3000 mapping).
• web/README.md - container quickstart.

Scope

Container + compose + CI validation + README. The full Helm chart (deploy/helm/web) is a focused follow-up (#290b), mirroring the #289 split.

Gate chain

• critic: GO-WITH-CHANGES (port 8082 not 3000 grafana-clash; exact docker build web context; Trivy added; grep -i; single listen - all applied).
• security-auditor (opus): PASS - non-root by construction, no push/deploy, no workflow injection, server_tokens off, .dockerignore excludes .env/.git, Trivy gate, clean-room clean, no secrets.
• code-reviewer: 2 HIGH (CI non-root assert + readiness hard-fail with explicit exit + docker logs) + 2 should-fix (gzip + cache headers) - all adopted.
• evaluator: PASS (0.88).
  Docker is not buildable locally (WSL); the CI docker job is the validation gate.

Closes #290