build: drop the Flutter builder stage from the Docker image

The Flutter SDK image is ~2.8 GB and filled Docker Desktop's VM disk
("read-only file system" while extracting a layer). Build the web bundle
on the host instead and COPY client/app/build/web into the 2-stage
(NestJS build -> slim runtime) image. .dockerignore keeps the bundle,
drops the platform scaffolding. README documents the host `flutter build
web` prerequisite.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -8,17 +8,22 @@ for the full architecture and phased roadmap.
 ## Run with Docker
 
 ```bash
-cp backend/.env.example backend/.env      # fill in the secrets
-# put the Firebase service account at backend/serviceAccount.json (optional; push)
+cp backend/.env.example backend/.env               # fill in the secrets
+# optional (push): put the Firebase service account at backend/serviceAccount.json
+(cd client/app && flutter build web --release)     # host build — see note below
 docker compose up --build
 ```
 
-`docker-compose.yml` starts PostgreSQL 16 and one `api` container (multi-stage
-`Dockerfile`: Flutter web build → NestJS build → slim runtime). The container
-runs `prisma migrate deploy` on start and serves the whole app — Flutter web
+`docker-compose.yml` starts PostgreSQL 16 and one `api` container (2-stage
+`Dockerfile`: NestJS build → slim runtime). The container runs
+`prisma migrate deploy` on start and serves the whole app — Flutter web
 client + REST API — on <http://localhost:3000>. Requires Docker Compose v2.
-Secrets are read from `backend/.env` and the service-account JSON is bind-
-mounted read-only; neither is baked into the image.
+
+The Flutter web bundle is built **on the host** and copied in (a Flutter
+builder stage would pull a ~2.8 GB SDK image). So `flutter build web` must
+run before `docker compose build`. Secrets come from `backend/.env`
+(unquoted, Compose v2 strips quotes) and the service-account JSON is
+bind-mounted read-only — neither is baked into the image.
 
 ## Structure