feat: F5.6b server F as an image: the editor from F itself, one stack per environment

F hands out the editor's page and bundle (editor/ beside main.mjs, or
FILIUS_EDITOR_DIR): GET and HEAD only, one wall against leaving the folder,
F's own routes first, assets/ cached a year, the rest asked for again; the
build lays .br and .gz beside the files and F sends the better one the
browser takes (bundle 695 KB to 212 KB).

deploy/Dockerfile: two stages, Node 24, no node_modules, not root.
deploy/docker-compose.yml with an env file per environment: the file sets
the stack's name, volume, image tag and port (test 8081, production 8080).
Measured with both stacks side by side behind nginx and Chromium.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/production.env.example

@@ -0,0 +1,23 @@
+# Server F, production environment: copy to deploy/production.env and fill in the empty
+# values (deploy/*.env is not in git). Started with
+#
+#   docker compose -f deploy/docker-compose.yml --env-file deploy/production.env up -d --build
+
+# The stack's name: containers, volume and image tag (docker-compose.yml).
+FILIUS_STACK=filius-production
+
+# Where the openresty reaches F: the address of the LXC container, and the
+# port deploy/proxy.conf names for filius.hub.mdg-hamburg.de.
+FILIUS_BIND=
+FILIUS_PUBLIC_PORT=8080
+
+# The origin of the page the editor runs in: this environment's own name.
+FILIUS_ORIGINS=https://filius.hub.mdg-hamburg.de
+
+# Hex only (openssl rand -hex 32): the password goes into F's database URL.
+FILIUS_DB_PASSWORD=
+
+# The same values as in the environment of dashboard (it signs the
+# tickets and calls /svc/* with the key). Each environment its own.
+FILIUS_TICKET_SECRET=
+FILIUS_SERVICE_KEY=