One image for the whole app: engine, API and dashboard on one port

The backend image now builds the SPA and serves it on the API's own origin
(fluksio/spa.py), so an instance is a single container with no proxy, DNS,
port 80 or .env: `docker compose up -d` with the new compose.yml runs it on
localhost:8080. It starts on fluksio serve (persisted secret key, first
admin printed once) and brings its own Redis when REDIS_HOST is unset.

Slimmer: python:3.13-slim, no dev group, uv once, fastapi without the cloud
CLI. Optional features are per-feature extras (mqtt, influx, email, sentry,
ml, server for all) picked with the EXTRAS build argument; numpy moved to
`ml`. ffmpeg left the image for imageio-ffmpeg via the Modules screen.

The operator stack runs the same image with app. and api. routed to it; the
nginx frontend service, the LAN nginx proxy and DOMAIN in the backend are
gone, and the MCP issuer is FRONTEND_HOST.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -5,24 +5,19 @@
 # Domain Traefik routes on and acquires TLS certificates for.
 DOMAIN=localhost
 
-# Used by the backend to build links in outgoing emails.
+# The address people and devices reach this instance at: panel links, mails
+# and the MCP issuer are built from it.
 FRONTEND_HOST=http://localhost:5173
 
 # local, staging, production
 ENVIRONMENT=local
 
-# Baked into the SPA at build time: the address the interface calls. The
-# workspace root's scripts/setup.sh derives it from DOMAIN and ENVIRONMENT —
-# plain http for a local target, where nothing terminates TLS.
-VITE_API_URL=http://api.localhost
-
 PROJECT_NAME="Fluksio"
 STACK_NAME=fluksio-app
 
-# Backend
-# `http://frontend` is the compose-network origin the Playwright job loads the
-# SPA from (docker/compose.ci.yml); without it every spec fails CORS at login.
-BACKEND_CORS_ORIGINS="http://localhost,http://localhost:5173,http://app.localhost,https://localhost,https://localhost:5173,http://frontend"
+# Backend. The image serves the dashboard on the API's own origin, so these
+# only matter to a dashboard served from elsewhere, such as the Vite server.
+BACKEND_CORS_ORIGINS="http://localhost,http://localhost:5173,http://app.localhost,https://localhost,https://localhost:5173"
 SECRET_KEY=changethis
 FIRST_SUPERUSER=admin@fluksio.com
 FIRST_SUPERUSER_PASSWORD=changethis
@@ -49,16 +44,19 @@ POSTGRES_DB=app
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=changethis
 
-# Redis — flow engine state. Empty keeps the state in memory; the compose stack
-# points the backend at its own `redis` service.
+# Redis — flow engine state. Empty keeps the state in memory in a checkout, and
+# the image starts a Redis of its own; the compose stack points the backend at
+# its own `redis` service.
 REDIS_HOST=
 REDIS_PORT=6379
 
 SENTRY_DSN=
 
-# Docker registry images
+# Docker registry image
 DOCKER_IMAGE_BACKEND=fluksio-backend
-DOCKER_IMAGE_FRONTEND=fluksio-frontend
+# Optional features built into it, comma separated: mqtt, influx, email,
+# sentry, ml, or server for all of them. Empty is the minimal engine.
+EXTRAS=server
 
 # The MCP endpoint agents connect to, and the OAuth server behind it.
 MCP_ENABLED=true