Add Docker support: Arch/Apache/PHP image, three volumes, docs

Adds a root Dockerfile (Arch Linux + Apache + PHP) and docker-compose.yml
with separate cache/data/images volumes, so a project's own content,
page cache, and future uploaded images stay out of paths a framework
update would wipe. App/ is baked into the image but can be bind-mounted
to override without a rebuild. Renames the Sass build-tool Dockerfile
example in the styling doc to Dockerfile.sass to avoid colliding with
the new app Dockerfile, adds a new /admin/docs/docker page (linked from
the docs index and nav), and documents the reserved images/ directory
in AGENTS.md and README.

Also records the user's git/docker execution permission boundaries in
CLAUDE.md for future sessions.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -43,6 +43,14 @@ Visit `http://127.0.0.1:8000/` for the static home page, then click around — `
 
 Point the vhost's document root at `public/`, make sure `mod_rewrite` is enabled and `AllowOverride All` is set for that directory so `public/.htaccess` takes effect, and it just works — no build step required.
 
+### Run it in Docker
+
+```
+docker compose up --build
+```
+
+Builds an Arch Linux-based Apache/PHP image and serves the site at `http://localhost:8080/`. Three named volumes (`cache`, `data`, `images`) keep the page cache, SQLite database, and a reserved-for-later images directory out of paths the "Updating the framework" workflow below would wipe; `App/` is baked into the image but can be bind-mounted for edits without a rebuild. See [Docker](http://127.0.0.1:8000/admin/docs/docker) for details.
+
 ### Starting a new project
 
 Clone this repo and drop its Git history — no Composer scaffold or installer:
@@ -86,6 +94,7 @@ php novaconium/bin/create-static-page.php blog/my-new-post
 The full framework documentation — routing, sidecars, libraries, database, session, content index, XML sitemap, RSS feeds, layouts, static caching, SEO, Matomo analytics, admin authentication, draft pages, styling, project layout, and third-party notices — lives at `/admin/docs` on any running instance (so it travels with the code, no internet connection needed). Highlights:
 
 - [Getting started](http://127.0.0.1:8000/admin/docs/getting-started)
+- [Docker](http://127.0.0.1:8000/admin/docs/docker)
 - [Routing](http://127.0.0.1:8000/admin/docs/routing)
 - [Sidecars](http://127.0.0.1:8000/admin/docs/sidecars)
 - [Libraries](http://127.0.0.1:8000/admin/docs/libraries)