Add Docker support: Arch/Apache/PHP image, three volumes, docs

Adds a root Dockerfile (Arch Linux + Apache + PHP) and docker-compose.yml
with separate cache/data/images volumes, so a project's own content,
page cache, and future uploaded images stay out of paths a framework
update would wipe. App/ is baked into the image but can be bind-mounted
to override without a rebuild. Renames the Sass build-tool Dockerfile
example in the styling doc to Dockerfile.sass to avoid colliding with
the new app Dockerfile, adds a new /admin/docs/docker page (linked from
the docs index and nav), and documents the reserved images/ directory
in AGENTS.md and README.

Also records the user's git/docker execution permission boundaries in
CLAUDE.md for future sessions.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

AGENTS.md

@@ -246,6 +246,19 @@ index below) before `App/migrations/` (project schema) — see the
 project adds still defaults to no `migrations_dir` at all unless it sets
 one; the two-root default is specific to `default`.
 
+A sibling top-level `images/` directory (same gitignore-wholesale-with-
+`.gitkeep` treatment as `public/cache/`) exists as **reserved scaffolding
+for a future image-upload feature — no config key, no upload code, nothing
+reads or writes it yet.** It's deliberately a separate directory from
+`data/`, not nested under it, even though both are "project data that
+survives a framework update": a project may run MySQL, or no database at
+all, so coupling image storage to the SQLite volume would be wrong. See
+`novaconium/pages/admin/docs/docker/index.twig` for how the Docker Compose
+setup gives it its own volume. Don't add an `images_dir` config key until
+an actual feature reads it — an unused key would misrepresent the
+framework's state, the same reasoning that keeps every other config key
+tied to real consuming code.
+
 `Lib\Session` (`novaconium/lib/Session.php`) is a thin wrapper around
 native PHP sessions (`session_start()`/`$_SESSION`, not a custom store),
 all-static and lazy-start like `Lib\Csrf` — nothing calls `session_start()`