Add make dev-lan: the app on a host port, API proxied on the same origin

docker/compose.lan.yml

@@ -0,0 +1,19 @@
+# Direct LAN access — layered on top of compose.local.yml by `make dev-lan`.
+#
+# For reaching the app from a machine that cannot be given a DNS record or a
+# hosts entry. Traefik routes on the Host header and a bare IP matches no
+# router, so the frontend is published on a host port instead and proxies the
+# API on that same port: http://<host-ip>:${APP_PORT} is the whole app.
+services:
+
+  frontend:
+    ports: !override
+      - "${APP_PORT:-8080}:80"
+    volumes:
+      - ./nginx-api-proxy.conf:/etc/nginx/extra-conf.d/backend-not-found.conf:ro
+    build:
+      args:
+        # Empty on purpose: the client then addresses the API as a path on
+        # whichever origin served the page, so one build works through
+        # app.${DOMAIN}, the published port, and an ssh tunnel alike.
+        - VITE_API_URL=