Stop tracking the built web UI; build it in the Docker image instead

src/handler/api/static/ was a committed build artifact: Next's content-hashed
chunk names churn on every build, so any two branches touching frontend/ were
guaranteed merge conflicts there, PR diffs drowned in generated churn, and a
forgotten `npm run export` could silently ship a UI older than its source.

- gitignore the export (plus frontend/out and .next were already covered) and
  remove the 52 tracked files.
- Dockerfile grows a `ui` stage (npm ci + npm run build) whose output is copied
  into the packaged tree before pip install, so the image published by docker.yml
  always carries a UI built from exactly that commit's source — the frontend
  build is now effectively part of CI with no new workflow.
- .dockerignore excludes frontend artifacts and any stale local export: COPY
  into src/handler/api/static merges, so a checkout copy must never leak in.
- pyproject: hatchling skips VCS-ignored files, so `artifacts` re-includes the
  export when present; absent it, the wheel builds fine and the API just runs
  headless (it only mounts static/ when the directory exists).
- README documents the two build paths (Docker stage vs `npm run export` for
  source installs) and the headless fallback.

Verified: wheel with the export present ships all 52 files (memory page
included); wheel without it builds clean and create_app() skips the UI mount.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WYqkoYPX8NAo1V2KyXr1pk

README.md

@@ -498,9 +498,17 @@ the API (same contract as `curl`): the browser prompts for the token once, store
 `localStorage`, and attaches it to every call. All API values render as React text
 (never `dangerouslySetInnerHTML`) so agent-authored strings can't inject markup.
 
-The build output is committed to `src/handler/api/static/` so the Python wheel ships it and
-FastAPI serves it same-origin — there is no separate frontend server and no node step in the
-Docker image. Rebuild after changing the UI:
+The build output lands in `src/handler/api/static/`, which FastAPI serves same-origin —
+there is no separate frontend server. The export is a **generated artifact and is
+gitignored**, not committed: tracked builds guaranteed merge conflicts (Next's
+content-hashed chunk names churn on every build) and let the served UI drift from its
+source. It gets built in one of two places:
+
+- **Docker** (the normal path): the [`Dockerfile`](Dockerfile)'s `ui` stage runs
+  `npm ci && npm run build` and copies the export into the packaged tree, so the image
+  published by [`docker.yml`](.github/workflows/docker.yml) always carries a UI built
+  from exactly the source in that commit.
+- **Source installs**: build it yourself before (or after) `pip install`:
 
 ```bash
 cd frontend
@@ -509,6 +517,9 @@ npm run build            # static export → frontend/out/
 npm run export           # build, then sync frontend/out/ → src/handler/api/static/
 ```
 
+Without that step a source install still works — the API only mounts `static/` when the
+directory exists, so it just runs headless (API-only).
+
 `npm run dev` runs the UI against a live API on another origin — set
 `NEXT_PUBLIC_API_BASE=http://127.0.0.1:8000` and enable `CORS_ORIGINS` on the API.
 
@@ -523,7 +534,7 @@ src/handler/
                        # forge/gitops seams, credentials, skills_gen, CI poller
   hooks/               # Stop/SessionEnd, PreToolUse gate (push + approval), Notification
   migrations/          # Alembic env + versions
-  api/static/          # built Next.js export (generated — see frontend/)
+  api/static/          # built Next.js export (generated + gitignored — see frontend/)
 frontend/              # Next.js dashboard source (builds to api/static/)
 tests/                 # DB, API, hook, and control tests (SQLite)
 docs/PLAN.md           # full design + phased roadmap (the original plan of action)