Add Docker support: Arch/Apache/PHP image, three volumes, docs

Adds a root Dockerfile (Arch Linux + Apache + PHP) and docker-compose.yml
with separate cache/data/images volumes, so a project's own content,
page cache, and future uploaded images stay out of paths a framework
update would wipe. App/ is baked into the image but can be bind-mounted
to override without a rebuild. Renames the Sass build-tool Dockerfile
example in the styling doc to Dockerfile.sass to avoid colliding with
the new app Dockerfile, adds a new /admin/docs/docker page (linked from
the docs index and nav), and documents the reserved images/ directory
in AGENTS.md and README.

Also records the user's git/docker execution permission boundaries in
CLAUDE.md for future sessions.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,40 @@
+# Arch Linux + Apache + PHP image for running novaconium in production.
+# See /admin/docs/docker for volumes, overriding App/ without a rebuild,
+# and optional MySQL wiring.
+FROM archlinux:base
+
+RUN pacman -Syu --noconfirm --needed apache php php-apache sqlite \
+    && pacman -Scc --noconfirm
+
+# php-apache on Arch is built against mpm_prefork, not httpd's default
+# mpm_event — swap MPMs, enable mod_rewrite, point DocumentRoot at
+# public/, and wire in mod_php.
+RUN sed -i \
+      -e 's/^LoadModule mpm_event_module/#LoadModule mpm_event_module/' \
+      -e 's/^#LoadModule mpm_prefork_module/LoadModule mpm_prefork_module/' \
+      -e '/^#LoadModule rewrite_module/s/^#//' \
+      -e 's#DocumentRoot "/srv/http"#DocumentRoot "/var/www/html/public"#' \
+      -e 's#<Directory "/srv/http">#<Directory "/var/www/html/public">#' \
+      -e 's/^AllowOverride None/AllowOverride All/' \
+      /etc/httpd/conf/httpd.conf \
+    && printf '\nLoadModule php_module modules/libphp.so\nAddHandler php-script .php\nDirectoryIndex index.php index.html\nServerName localhost\n' \
+       >> /etc/httpd/conf/httpd.conf \
+    && sed -i \
+      -e 's/^;extension=pdo_sqlite/extension=pdo_sqlite/' \
+      -e 's/^;extension=pdo_mysql/extension=pdo_mysql/' \
+      /etc/php/php.ini
+
+WORKDIR /var/www/html
+
+COPY novaconium/ ./novaconium/
+COPY public/ ./public/
+COPY App/ ./App/
+
+# Runtime-writable paths not covered by named volumes in docker-compose.yml.
+RUN mkdir -p public/cache data images \
+    && touch novaconium/contact-log.txt \
+    && chown -R http:http public/cache data images App novaconium/contact-log.txt
+
+EXPOSE 80
+
+CMD ["httpd", "-D", "FOREGROUND"]