Feature 24: commit the admin PWA hosting artifacts and runbook section

Make the live admin PWA deployment reproducible from the repository:

- deploy/pwa/Dockerfile: multi-stage build (node:22-alpine builds admin/
  with the VITE_* build args, failing fast if any is empty; nginx:alpine
  pinned to the digest running on the API box serves dist/).
- deploy/pwa/Dockerfile.dockerignore: limits the repo-root context to
  admin/ sources and nginx.conf (the root .dockerignore excludes deploy/).
- deploy/pwa/nginx.conf: SPA fallback to index.html, root-served
  /sw.js and /manifest.webmanifest, allow-list 10.60.1.33 and
  10.60.1.14 only.
- deploy/compose.yaml: pwa service on NESTQUEST_BIND_ADDRESS:8081 with
  the build args from deploy/.env; api and litestream unchanged.
- deploy/.env.example: the three public PWA build values.
- deploy/RUNBOOK.md: section 10 (PWA build/serve, nestquest-app Traefik
  router, verification) and the router priorities in section 3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/.env.example

@@ -21,3 +21,14 @@ NESTQUEST_OIDC_JWKS_URL=
 # unset; on the API box set the LAN address the reverse proxy
 # forwards to, e.g. 10.60.1.14.
 NESTQUEST_BIND_ADDRESS=
+
+# Admin PWA build args (compose interpolation into the pwa service's
+# VITE_* build args; baked into the bundle, so rebuild after changing).
+# PUBLIC values, not secrets: the Authentik application is a PKCE client
+# with no client secret.  All three are required — the pwa image build
+# fails when any is empty.
+#   NESTQUEST_AUTHENTIK_ISSUER=https://auth.cubecraftlabs.com/application/o/nestquest/
+#   NESTQUEST_API_BASE_URL=https://nestquest.cubecraftlabs.com
+NESTQUEST_AUTHENTIK_CLIENT_ID=
+NESTQUEST_AUTHENTIK_ISSUER=
+NESTQUEST_API_BASE_URL=