One image for the whole app: engine, API and dashboard on one port

The backend image now builds the SPA and serves it on the API's own origin
(fluksio/spa.py), so an instance is a single container with no proxy, DNS,
port 80 or .env: `docker compose up -d` with the new compose.yml runs it on
localhost:8080. It starts on fluksio serve (persisted secret key, first
admin printed once) and brings its own Redis when REDIS_HOST is unset.

Slimmer: python:3.13-slim, no dev group, uv once, fastapi without the cloud
CLI. Optional features are per-feature extras (mqtt, influx, email, sentry,
ml, server for all) picked with the EXTRAS build argument; numpy moved to
`ml`. ffmpeg left the image for imageio-ffmpeg via the Modules screen.

The operator stack runs the same image with app. and api. routed to it; the
nginx frontend service, the LAN nginx proxy and DOMAIN in the backend are
gone, and the MCP issuer is FRONTEND_HOST.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/code/workers.md

@@ -9,7 +9,7 @@ WebSocket. Keep one engine; add workers where the hardware lives.
 On the engine, use a superuser access token. In these examples:
 
 - `API_URL` is the engine's API base, including `/api/v1`, such as
-  `https://api.example.com/api/v1` or `http://localhost:8080/api/v1` for a LAN stack.
+  `https://fluksio.example.com/api/v1` or `http://localhost:8080/api/v1` for a Docker container.
 - `TOKEN` is your superuser bearer token. The login endpoint
   `POST /api/v1/login/access-token` accepts form fields `username` and `password`.
 
@@ -36,7 +36,7 @@ pip install fluksio-worker
 export FLUKSIO_WORKER_TOKEN='<token from the engine>'
 
 fluksio-worker \
-  --url wss://api.example.com/api/v1/workers/attach \
+  --url wss://fluksio.example.com/api/v1/workers/attach \
   --labels gpu,cuda12 \
   --python /opt/torch-venv/bin/python
 ```
@@ -163,7 +163,7 @@ in `$DATA_DIR/provisioners.json`, replacing the example addresses and paths:
   "name": "hpc",
   "login": "me@login.cluster",
   "ssh_key": "/secrets/hpc_ed25519",
-  "engine_url": "wss://api.example.com/api/v1/workers/attach",
+  "engine_url": "wss://fluksio.example.com/api/v1/workers/attach",
   "max_idle_s": 300,
   "provision_timeout_s": 900,
   "profiles": [{