Portal app-shell as a busybox target, git without perl, quieter first start

The portal's copy of the dashboard is the `appshell` target of
backend/Dockerfile (18 MB instead of the 252 MB nginx image); the nginx
frontend Dockerfile, its confs and csp.check.ts are gone, since the app and
the hub both hash the CSP from the index.html they serve.

The runtime image copies the 4 MB git binary alone: the store's init, add,
commit, gc and rev-parse are builtins, and a build-time round trip fails the
build if that ever changes. About 100 MB of perl and helpers less.

The bundled Redis's overcommit warning and FastMCP's lifespan warning no
longer greet every `docker logs`.

frontend/src/csp.check.ts

@@ -1,33 +0,0 @@
-/**
- * The CSP's hash for the theme script, checked against the script.
- *
- * ponytail: a script rather than a suite, as with the other `.check.ts` files:
- *
- *     cd frontend && bun run src/csp.check.ts
- *
- * `index.html` runs one inline script, the theme class before first paint, and
- * `nginx-security-headers.conf` admits it by its sha256. Edit one without the
- * other and the browser blocks the script, so the app paints light-then-dark
- * again, with nothing failing anywhere but the console.
- */
-
-import assert from "node:assert/strict"
-import { createHash } from "node:crypto"
-import { readFileSync } from "node:fs"
-
-const read = (path: string) =>
-  readFileSync(new URL(path, import.meta.url), "utf8")
-
-const inline = [
-  ...read("../index.html").matchAll(/<script>([\s\S]*?)<\/script>/g),
-]
-assert.equal(inline.length, 1, "index.html has one inline script")
-
-const hash = createHash("sha256").update(inline[0][1]).digest("base64")
-const csp = read("../nginx-security-headers.conf")
-assert.ok(
-  csp.includes(`'sha256-${hash}'`),
-  `the theme script's hash is not in nginx-security-headers.conf; set it to 'sha256-${hash}'`,
-)
-
-console.log("csp: ok")

frontend/src/lib/zodConfig.ts

@@ -2,7 +2,7 @@
  * Zod without its `eval` probe.
  *
  * Zod compiles a faster object parser with `new Function` where it can, and
- * finds out by trying once. Under the CSP (`frontend/nginx-security-headers.conf`)
+ * finds out by trying once. Under the CSP (`backend/fluksio/spa.py`)
  * that try is reported as a violation on every page, although Zod catches it
  * and falls back. `jitless` skips the probe and goes straight to the fallback.
  * Imported first in `main.tsx`, since a schema built before it would probe.