Stop tracking the built web UI; build it in the Docker image instead

src/handler/api/static/ was a committed build artifact: Next's content-hashed
chunk names churn on every build, so any two branches touching frontend/ were
guaranteed merge conflicts there, PR diffs drowned in generated churn, and a
forgotten `npm run export` could silently ship a UI older than its source.

- gitignore the export (plus frontend/out and .next were already covered) and
  remove the 52 tracked files.
- Dockerfile grows a `ui` stage (npm ci + npm run build) whose output is copied
  into the packaged tree before pip install, so the image published by docker.yml
  always carries a UI built from exactly that commit's source — the frontend
  build is now effectively part of CI with no new workflow.
- .dockerignore excludes frontend artifacts and any stale local export: COPY
  into src/handler/api/static merges, so a checkout copy must never leak in.
- pyproject: hatchling skips VCS-ignored files, so `artifacts` re-includes the
  export when present; absent it, the wheel builds fine and the API just runs
  headless (it only mounts static/ when the directory exists).
- README documents the two build paths (Docker stage vs `npm run export` for
  source installs) and the headless fallback.

Verified: wheel with the export present ships all 52 files (memory page
included); wheel without it builds clean and create_app() skips the UI mount.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WYqkoYPX8NAo1V2KyXr1pk

Dockerfile

@@ -1,5 +1,17 @@
 # syntax=docker/dockerfile:1
 
+# ---- ui stage: build the dashboard's static export ----
+# The export is a generated artifact (gitignored), so the image builds it here rather
+# than trusting the checkout to carry it. package*.json is copied alone first so the
+# npm ci layer caches until the lockfile actually changes.
+FROM node:20-slim AS ui
+
+WORKDIR /ui
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY frontend ./
+RUN npm run build
+
 # ---- build stage: install the package + deps into an isolated venv ----
 FROM python:3.11-slim AS builder
 
@@ -12,6 +24,10 @@ ENV PATH="/opt/venv/bin:$PATH"
 WORKDIR /build
 COPY pyproject.toml README.md ./
 COPY src ./src
+# Drop the built UI into the packaged tree before pip install: hatchling ships every
+# non-.py file under src/handler, so the wheel carries the export and FastAPI serves it
+# same-origin — exactly what committing src/handler/api/static used to provide.
+COPY --from=ui /ui/out ./src/handler/api/static
 RUN pip install .
 
 # ---- runtime stage ----