One image for the whole app: engine, API and dashboard on one port

The backend image now builds the SPA and serves it on the API's own origin
(fluksio/spa.py), so an instance is a single container with no proxy, DNS,
port 80 or .env: `docker compose up -d` with the new compose.yml runs it on
localhost:8080. It starts on fluksio serve (persisted secret key, first
admin printed once) and brings its own Redis when REDIS_HOST is unset.

Slimmer: python:3.13-slim, no dev group, uv once, fastapi without the cloud
CLI. Optional features are per-feature extras (mqtt, influx, email, sentry,
ml, server for all) picked with the EXTRAS build argument; numpy moved to
`ml`. ffmpeg left the image for imageio-ffmpeg via the Modules screen.

The operator stack runs the same image with app. and api. routed to it; the
nginx frontend service, the LAN nginx proxy and DOMAIN in the backend are
gone, and the MCP issuer is FRONTEND_HOST.

docs/code/agents.md

@@ -5,13 +5,16 @@ and run flows with the permissions of the user who authorizes it.
 
 ## Connect an agent
 
-Set `MCP_ENABLED=true` in the engine's environment and restart it. The Python
-package defaults to off; the Docker template enables it.
+Set `MCP_ENABLED=true` in the engine's environment and restart it, under
+`environment` in `compose.yml` for the Docker container. It defaults to off.
 
 Configure your MCP client with an HTTP endpoint:
 
-- Local Docker stack: `http://api.localhost/mcp`
-- Deployment: `https://api.<your-domain>/mcp`
+- Docker container: `http://localhost:8080/mcp`
+- Deployment: `https://<your-domain>/mcp`
+
+The endpoint has to be the address in `FRONTEND_HOST`, which is also the
+issuer of the client's tokens.
 
 The client registers, opens browser authorization, and receives an OAuth
 token after you approve access. The issuer and browser redirects use