HH-738: add constrained browser container control (#4)

Dockerfile

@@ -0,0 +1,23 @@
+FROM node:22-alpine AS web
+WORKDIR /src/web
+COPY web/package*.json ./
+RUN npm ci
+COPY web/ ./
+RUN npm run build
+
+FROM golang:1.26-alpine AS go
+WORKDIR /src
+COPY go.mod ./
+COPY cmd/ ./cmd/
+RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /out/control-plane ./cmd/control-plane \
+    && CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /out/docker-gateway ./cmd/docker-gateway
+
+FROM alpine:3.22
+RUN addgroup -g 65532 app && adduser -D -u 65532 -G app app
+WORKDIR /app
+COPY --from=go /out/control-plane /out/docker-gateway /app/
+COPY --from=web /src/web/dist /app/web
+USER 65532:65532
+ENV WEB_DIR=/app/web
+EXPOSE 8080 8081
+CMD ["/app/control-plane"]