feat: F5.6b server F as an image: the editor from F itself, one stack per environment

F hands out the editor's page and bundle (editor/ beside main.mjs, or
FILIUS_EDITOR_DIR): GET and HEAD only, one wall against leaving the folder,
F's own routes first, assets/ cached a year, the rest asked for again; the
build lays .br and .gz beside the files and F sends the better one the
browser takes (bundle 695 KB to 212 KB).

deploy/Dockerfile: two stages, Node 24, no node_modules, not root.
deploy/docker-compose.yml with an env file per environment: the file sets
the stack's name, volume, image tag and port (test 8081, production 8080).
Measured with both stacks side by side behind nginx and Chromium.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/Dockerfile

@@ -0,0 +1,43 @@
+# Server F as an image: the Filius service and the editor's page in one.
+#
+# Built from the repository's root (the build needs every package and the
+# corpus, whose FILIUS examples the editor carries):
+#
+#   docker compose -f deploy/docker-compose.yml --env-file deploy/test.env build
+#
+# Two stages. The first installs everything and builds: esbuild bundles the
+# service into main.mjs and its room thread into simWorker.mjs, with every
+# dependency inside; Vite builds the editor; precompressMain.mjs lays a .br
+# and a .gz beside its files. The second stage takes only these files, so
+# the image holds no node_modules, no sources and no compiler.
+#
+# Node 24 (active LTS), not the 20 of the development machines: 20 has had
+# no security fixes since April 2026, and a service facing the browsers of a
+# whole school should not run on it. The bundles are built for node20 and
+# run unchanged on 24; the image's run is checked before each release (see
+# the README).
+
+FROM node:24-alpine AS build
+WORKDIR /src
+COPY . .
+RUN npm ci --no-audit --no-fund
+RUN npm run build -w @mdg-filius/server \
+ && npm run build -w @mdg-filius/editor \
+ && node packages/server/dist/precompressMain.mjs packages/editor/dist
+
+FROM node:24-alpine
+LABEL org.opencontainers.image.title="mdg-filius" \
+      org.opencontainers.image.description="Filius network simulation, shared editing (server F)" \
+      org.opencontainers.image.licenses="GPL-3.0-only"
+ENV NODE_ENV=production
+WORKDIR /app
+COPY --from=build /src/packages/server/dist/main.mjs /src/packages/server/dist/simWorker.mjs ./
+COPY --from=build /src/packages/editor/dist ./editor
+COPY LICENSE README.md CHANGES.md ./
+# Not root: F needs no privilege, and a hole in it should not get one.
+USER node
+EXPOSE 8080
+# The proxy keeps no watch of its own; this one shows in `docker compose ps`.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz || exit 1
+CMD ["node", "main.mjs"]