Make Docker bind mounts actually work; refresh homepage feature grid

App/, cache/, uploads/, and data/ are now bind-mounted by default, so
docker-entrypoint.sh seeds an empty App/ from a build-time backup and
re-chowns the mounted paths to http:http on every start (a bind mount
doesn't inherit a named volume's ownership or get seeded from the image
the way COPY does). Also fixes AllowOverride never actually being
enabled (the sed pattern didn't account for httpd.conf's indentation,
so only DirectoryIndex-served routes worked) and pins Apache/PHP/SQLite
to a dated Arch Linux Archive snapshot for reproducible builds.

Homepage's feature grid was six cards behind what's actually shipped;
brought it in line with the features blog post.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,14 +1,13 @@
 services:
   web:
-    build: .
+    image: novaconium-beta
     ports:
       - "8080:80"
     volumes:
-      - cache:/var/www/html/public/cache
-      - uploads:/var/www/html/public/uploads
-      - data:/var/www/html/data
-      # Uncomment to override the baked-in App/ with a host copy, no rebuild:
-      # - ./App:/var/www/html/App
+      - ${VOL_PATH:-/data}/novaconium/cache:/var/www/html/public/cache
+      - ${VOL_PATH:-/data}/novaconium/uploads:/var/www/html/public/uploads
+      - ${VOL_PATH:-/data}/novaconium/App:/var/www/html/App
+      - ${VOL_PATH:-/data}/novaconium/data:/var/www/html/data
 
   # Optional — only needed if App/config.php adds a db_connections entry
   # with driver: mysql. See /admin/docs/database.
@@ -21,9 +20,3 @@ services:
   #     MYSQL_ROOT_PASSWORD: change-me
   #   volumes:
   #     - mysql-data:/var/lib/mysql
-
-volumes:
-  cache:
-  uploads:
-  data:
-  # mysql-data: