One image for the whole app: engine, API and dashboard on one port

The backend image now builds the SPA and serves it on the API's own origin
(fluksio/spa.py), so an instance is a single container with no proxy, DNS,
port 80 or .env: `docker compose up -d` with the new compose.yml runs it on
localhost:8080. It starts on fluksio serve (persisted secret key, first
admin printed once) and brings its own Redis when REDIS_HOST is unset.

Slimmer: python:3.13-slim, no dev group, uv once, fastapi without the cloud
CLI. Optional features are per-feature extras (mqtt, influx, email, sentry,
ml, server for all) picked with the EXTRAS build argument; numpy moved to
`ml`. ffmpeg left the image for imageio-ffmpeg via the Modules screen.

The operator stack runs the same image with app. and api. routed to it; the
nginx frontend service, the LAN nginx proxy and DOMAIN in the backend are
gone, and the MCP issuer is FRONTEND_HOST.

docker/compose.lan.yml

@@ -2,26 +2,15 @@
 #
 # For reaching the app from a machine that cannot be given a DNS record or a
 # hosts entry. Traefik routes on the Host header and a bare IP matches no
-# router, so the frontend is published on a host port instead and proxies the
-# API and the hooks on that same port: http://<host-ip>:${APP_PORT} is the
-# whole app.
+# router, so the app container is published on a host port as well:
+# http://<host-ip>:${APP_PORT} is the whole app, dashboard, API and hooks.
 services:
 
   backend:
+    ports: !override
+      - "${APP_PORT:-8080}:8000"
     environment:
       # The address the instance gives out: the link the Panels dialog shows a
       # screen and the one its emails carry. app.${DOMAIN} resolves on this host
       # only, so `make dev-lan` passes the published port on the LAN address.
       - FRONTEND_HOST=${LAN_URL:-http://app.${DOMAIN:-localhost}}
-
-  frontend:
-    ports: !override
-      - "${APP_PORT:-8080}:80"
-    volumes:
-      - ./nginx-api-proxy.conf:/etc/nginx/extra-conf.d/backend-not-found.conf:ro
-    build:
-      args:
-        # Empty on purpose: the client then addresses the API as a path on
-        # whichever origin served the page, so one build works through
-        # app.${DOMAIN}, the published port, and an ssh tunnel alike.
-        - VITE_API_URL=