One image for the whole app: engine, API and dashboard on one port

The backend image now builds the SPA and serves it on the API's own origin
(fluksio/spa.py), so an instance is a single container with no proxy, DNS,
port 80 or .env: `docker compose up -d` with the new compose.yml runs it on
localhost:8080. It starts on fluksio serve (persisted secret key, first
admin printed once) and brings its own Redis when REDIS_HOST is unset.

Slimmer: python:3.13-slim, no dev group, uv once, fastapi without the cloud
CLI. Optional features are per-feature extras (mqtt, influx, email, sentry,
ml, server for all) picked with the EXTRAS build argument; numpy moved to
`ml`. ffmpeg left the image for imageio-ffmpeg via the Modules screen.

The operator stack runs the same image with app. and api. routed to it; the
nginx frontend service, the LAN nginx proxy and DOMAIN in the backend are
gone, and the MCP issuer is FRONTEND_HOST.

docs/getting-started/facility-automation.md

@@ -3,40 +3,43 @@
 Build a small temperature flow, then connect a real sensor when you're ready.
 No hardware required for the first lap.
 
-## Start the Docker stack
+## Start Fluksio
 
-You need Git, Docker with Compose v2, `make`, and `openssl`. Port 80 must be
-free. Clone the public app repository and run its commands from the repo root:
+You need Git and Docker with Compose v2. Clone the app repository and start
+its single container:
 
 ```sh
 git clone https://git.stroblme.de/Fluksio/app.git fluksio
 cd fluksio
-make init
-make dev-local
+docker compose up -d
+docker compose logs fluksio
 ```
 
-`make init` creates `.env`, generates secrets, creates the `proxy` network,
-and prints your admin login. It is safe to run again: existing secrets stay
-as they are.
+The first build takes a few minutes. The log shows the admin account and its
+password once, on the first start. Open [http://localhost:8080](http://localhost:8080)
+and sign in. Adding Python code requires that superuser account.
 
-Give the containers a moment to start on the first build, then open
-[http://app.localhost](http://app.localhost). Sign in with the admin login:
-adding Python code requires a superuser account. The API is at
-[http://api.localhost](http://api.localhost), and the docs are at
-[http://docs.localhost](http://docs.localhost).
+Everything runs in that one container on one port: the engine, its API and the
+dashboard. To use another port, change the left side of `ports` in
+`compose.yml`, for example `"9000:8000"`. From another machine on your network,
+open `http://<host-ip>:8080`. Set `FRONTEND_HOST` in `compose.yml` to the
+address you open, since links for wall panels and mails are built from it.
 
-For a Docker instance reached from another machine on your network, use:
+The image starts minimal. MQTT, InfluxDB, outbound mail and the rest are
+[extras](../reference/configuration.md#image-options). Add the ones you need to
+`EXTRAS` in `compose.yml` and rebuild:
+
+```yaml
+      args:
+        EXTRAS: "mqtt,influx"
+```
 
 ```sh
-make dev-lan
+docker compose up -d --build
 ```
 
-Open `http://<host-ip>:8080`. Choose another port with
-`make dev-lan APP_PORT=8081`. This is a development stack; see
-[running it long term](#run-it-long-term) before using it for a deployment.
-
-When you are done, stop the stack with `make down`. Your data volumes stay
-in place for the next start.
+Stop the container with `docker compose down`. Your data stays on the `data`
+volume for the next start.
 
 ## Your first flow
 
@@ -97,10 +100,8 @@ checking the payload format your device expects. A relay may need `ON` and
     and **Step** let you inspect queued messages one at a time. A real heating
     controller also needs appropriate limits and hysteresis.
 
-Docker development stacks include a test broker at `mosquitto:1883`; it has
-no published host port, so your physical sensors cannot reach it directly.
-For real sensors, use your own broker. The Docker image includes the MQTT
-and InfluxDB connector dependencies.
+The MQTT node needs the `mqtt` extra. Fluksio does not run a broker, so point
+the node at your own, such as Mosquitto.
 
 ## Show it on a dashboard
 
@@ -112,53 +113,38 @@ See [Dashboards and panels](../interface/dashboards.md) for widgets and pairing
 a wall tablet.
 
 For longer-term history, add an **InfluxDB** node that consumes
-`living_temperature`. Configure your server URL, organization, bucket, token
+`living_temperature`. It needs the `influx` extra. Configure your server URL, organization, bucket, token
 and `writes` mapping. Store the token under **Secrets** and select it in the
 node's credential field. [Node types](../reference/node-types.md#influxdb)
 has the write and query formats.
 
-The Docker development stack includes an InfluxDB test service at
-`http://influxdb:8086`, with organization and bucket `fluksio` and token
-`fluksio-dev-token`. It is for testing; configure a persistent InfluxDB server
-for data you want to keep. The production stack includes neither InfluxDB nor
-an MQTT broker.
+Fluksio does not run an InfluxDB server either. Use your own.
 
 ## Run it long term
 
-For a Docker deployment, run `make init`, then edit the repository's `.env`:
+The container from `compose.yml` is fit for long-term use. It restarts with
+Docker, and `/data` holds everything it keeps: the database, the flows,
+secrets, artifacts and its Redis. Back up that volume. Compose names it
+`fluksio_data`.
 
-| Setting | Example |
-|---|---|
-| `DOMAIN` | `example.com` |
-| `ENVIRONMENT` | `production` |
-| `FRONTEND_HOST` | `https://app.example.com` |
-| `VITE_API_URL` | `https://api.example.com` |
-| `BACKEND_CORS_ORIGINS` | `https://app.example.com` |
-| `FIRST_SUPERUSER` | your administrator email |
-| `TZ` | your timezone, such as `Europe/Berlin` |
+The container speaks plain HTTP. For access from outside your network, put a
+reverse proxy with HTTPS and WebSocket support in front of it, such as Caddy,
+Traefik or nginx, or [enroll with the portal](../interface/portal.md). A
+Caddyfile for `fluksio.example.com` is one line:
 
-Keep the generated secrets. Stop any development stack with `make down`.
-Set up DNS and a reverse proxy with HTTPS and WebSocket support before running
-`make up`. That target starts the application services; it requires a proxy
-on the Docker `proxy` network. Route
-`app.example.com` to `fluksio-app:80`, `api.example.com` to `fluksio-api:8000`
-and, optionally, `docs.example.com` to `fluksio-docs:80`.
+```text
+fluksio.example.com {
+	reverse_proxy localhost:8080
+}
+```
 
-`docker/compose.traefik.yml` is an optional proxy configuration. It also needs
-`EMAIL`, `USERNAME` and `HASHED_PASSWORD` for certificates and dashboard
-authentication; `make init` does not set these up.
+Set `FRONTEND_HOST` to `https://fluksio.example.com` and `TZ` to your
+timezone, such as `Europe/Berlin`. See [Configuration](../reference/configuration.md)
+for the other settings, which go under `environment` in `compose.yml`.
 
-The published port from `make dev-lan` uses HTTP. For access outside your
-network, use HTTPS or [enroll with the portal](../interface/portal.md).
+To update, pull the repository and rebuild:
 
-Back up `.env` and both persistent volumes: `app-flow-data` holds the database,
-flows, secrets and artifacts; `app-redis-data` holds message values, node state
-and queued work. Compose prefixes volume names with the project name
-`fluksio-app`. Also back up any external MQTT or InfluxDB data you need.
-
-## Next steps
-
-- [Flows, nodes and messages](../concepts/flows.md): how the graph works.
-- [Secrets, modules and alerts](../interface/operations.md): credentials and notifications.
-- [Remote workers](../code/workers.md): run node code on another machine.
-- [Configuration](../reference/configuration.md): settings and storage paths.
+```sh
+git pull
+docker compose up -d --build
+```