Add Docker support: Arch/Apache/PHP image, three volumes, docs

Adds a root Dockerfile (Arch Linux + Apache + PHP) and docker-compose.yml
with separate cache/data/images volumes, so a project's own content,
page cache, and future uploaded images stay out of paths a framework
update would wipe. App/ is baked into the image but can be bind-mounted
to override without a rebuild. Renames the Sass build-tool Dockerfile
example in the styling doc to Dockerfile.sass to avoid colliding with
the new app Dockerfile, adds a new /admin/docs/docker page (linked from
the docs index and nav), and documents the reserved images/ directory
in AGENTS.md and README.

Also records the user's git/docker execution permission boundaries in
CLAUDE.md for future sessions.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,29 @@
+services:
+  web:
+    build: .
+    ports:
+      - "8080:80"
+    volumes:
+      - cache:/var/www/html/public/cache
+      - data:/var/www/html/data
+      - images:/var/www/html/images
+      # Uncomment to override the baked-in App/ with a host copy, no rebuild:
+      # - ./App:/var/www/html/App
+
+  # Optional — only needed if App/config.php adds a db_connections entry
+  # with driver: mysql. See /admin/docs/database.
+  # db:
+  #   image: mysql:8
+  #   environment:
+  #     MYSQL_DATABASE: novaconium
+  #     MYSQL_USER: novaconium
+  #     MYSQL_PASSWORD: change-me
+  #     MYSQL_ROOT_PASSWORD: change-me
+  #   volumes:
+  #     - mysql-data:/var/lib/mysql
+
+volumes:
+  cache:
+  data:
+  images:
+  # mysql-data: