Add web frontend and Docker packaging

Frontend is a single page served from classpath resources with a JSON API
alongside it. Kept separate from the MCP tools because the consumers differ:
a model reads formatted text, a browser needs structures. Only the database
is shared.

The page has three views - catalog with edition details, copies, detected
facts with evidence and a filterable file list; script search with FTS5
snippets and a viewer; and a format breakdown. No build step, no CDN, no
dependencies; light and dark follow the system.

New `serve` command puts the frontend and MCP on one port, one process and
one database connection, which is also what the container runs. `mcp` alone
still works for a headless setup.

Docker is a two-stage build: JDK plus the Rex-EMoolator submodule to compile,
JRE for runtime. installDist rather than build, so check - and with it
verifyCoreVersion - is skipped and git is not needed in the image. The pinned
:core tag is extracted from gradle.properties at build time and passed in by
the entrypoint, otherwise copy.core_version would record "nieznana" and
derived-artifact invalidation would stop working. Properties go through
JAVA_OPTS because Gradle's launcher treats everything after the script name
as application arguments.

Compose mounts the collection read-only and keeps the database and script
cache in a named volume. The port is bound to loopback.

Not verified: the image itself does not build here, the Docker daemon is not
running on this machine. The launcher, JAVA_OPTS handling and resource
packaging were tested against the installDist output directly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,38 @@
+# Build wymaga submodułu vendor/Rex-EMoolator — composite build kompiluje :core
+# ze źródeł. Jeśli katalog jest pusty, settings.gradle przerwie z komunikatem.
+FROM eclipse-temurin:21-jdk AS build
+WORKDIR /src
+
+# najpierw sam opis buildu: zmiana w kodzie nie unieważnia pobranych zależności
+COPY gradlew settings.gradle build.gradle gradle.properties ./
+COPY gradle ./gradle
+COPY vendor ./vendor
+RUN ./gradlew --no-daemon dependencies --configuration runtimeClasspath > /dev/null 2>&1 || true
+
+COPY src ./src
+# installDist zamiast build: pomija check, a więc i verifyCoreVersion, które
+# potrzebowałoby gita w obrazie. Wersję i tak przypina submoduł.
+RUN ./gradlew --no-daemon installDist \
+ && grep '^coreVersion=' gradle.properties | cut -d= -f2 > /src/core-version
+
+FROM eclipse-temurin:21-jre
+WORKDIR /app
+
+# obrazy płyt montowane z zewnątrz, tylko do odczytu; katalog danych to wolumen
+VOLUME ["/data"]
+ENV CATALOG_DATA=/data \
+    JAVA_TOOL_OPTIONS="-Dfile.encoding=UTF-8"
+
+COPY --from=build /src/build/install/rex-catalog /app
+COPY --from=build /src/core-version /app/core-version
+COPY docker-entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh \
+ && useradd --system --uid 10001 --create-home katalog \
+ && mkdir -p /data /media \
+ && chown katalog:katalog /data
+USER katalog
+
+EXPOSE 8765
+ENTRYPOINT ["/app/entrypoint.sh"]
+# domyślnie wstajemy jako serwer; front i MCP dzielą port
+CMD ["serve", "--host", "0.0.0.0"]