Fix nginx serving no static assets in production compose (ported from qr-vip)

Same bug as qr-vip (2026-07-11): nginx and php-fpm are separate
containers in docker-compose.prod.yml, but nginx had no copy of the
static assets it needs to serve directly, so they'd fall through
try_files to the login-gated index.php. Not currently visible on
qr.ensembia.com (which runs docker-compose.yml, the single-container dev
variant, not this prod file) but would hit anyone using the production
compose as documented. New Dockerfile.nginx copies in dist/, plugins/,
manifest.json, service-worker.js, and favicon.ico.

Dockerfile.nginx

@@ -0,0 +1,14 @@
+FROM nginx:1.27-alpine
+
+# The php-dynamic-qrcode container builds the full app (incl. composer/vendor) into its
+# own image at /var/www/html. nginx runs as a separate container and has no access to
+# that filesystem, so it needs its own copy of just the static assets it serves directly
+# via try_files - everything else (*.php) is proxied to php-fpm regardless. Without this,
+# every static asset request (CSS/JS/manifest) falls through nginx's try_files to
+# index.php, which requires a login and silently redirects there instead of serving the
+# file.
+COPY src/dist /var/www/html/dist
+COPY src/plugins /var/www/html/plugins
+COPY src/manifest.json /var/www/html/manifest.json
+COPY src/service-worker.js /var/www/html/service-worker.js
+COPY src/favicon.ico /var/www/html/favicon.ico

docker-compose.prod.yml

@@ -1,6 +1,8 @@
 services:
   nginx:
-    image: "nginx:1.27-alpine"
+    build:
+      context: .
+      dockerfile: Dockerfile.nginx
     restart: "unless-stopped"
     ports:
       - "80:80"