build: add runtime-only Dockerfile + nginx hardening + allow dist in build context

Runtime-only Dockerfile.runtime copies a pre-built dist/ into the nginx
image; sidesteps the Node-on-emulation libuv crash when building on
Apple Silicon for linux/amd64.

nginx.conf hardened:
- HSTS, X-Content-Type-Options, X-Frame-Options DENY, Referrer-Policy
- Permissions-Policy locking down camera/microphone/geolocation/payment
- Content-Security-Policy with strict default-src self + connect-src
  scoped to our backend
- COOP / CORP same-origin
- X-Robots-Tag noindex (not a public marketing site)
- server_tokens off

Confidence: high
Scope-risk: narrow

.dockerignore

@@ -1,10 +1,8 @@
 node_modules
-dist
 qa/screenshots
 .git
 *.log
 .DS_Store
 .vscode
 .idea
-src/index.css.bak
 *.bak*

Dockerfile.runtime

@@ -0,0 +1,7 @@
+FROM nginx:1.27-alpine
+COPY dist/ /usr/share/nginx/html/
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+RUN sed -i '/listen.*80/a\    server_name _;' /etc/nginx/conf.d/default.conf || true
+EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
+  CMD wget -q --spider http://127.0.0.1/ || exit 1