Feature 24: commit the admin PWA hosting artifacts and runbook section

Make the live admin PWA deployment reproducible from the repository:

- deploy/pwa/Dockerfile: multi-stage build (node:22-alpine builds admin/
  with the VITE_* build args, failing fast if any is empty; nginx:alpine
  pinned to the digest running on the API box serves dist/).
- deploy/pwa/Dockerfile.dockerignore: limits the repo-root context to
  admin/ sources and nginx.conf (the root .dockerignore excludes deploy/).
- deploy/pwa/nginx.conf: SPA fallback to index.html, root-served
  /sw.js and /manifest.webmanifest, allow-list 10.60.1.33 and
  10.60.1.14 only.
- deploy/compose.yaml: pwa service on NESTQUEST_BIND_ADDRESS:8081 with
  the build args from deploy/.env; api and litestream unchanged.
- deploy/.env.example: the three public PWA build values.
- deploy/RUNBOOK.md: section 10 (PWA build/serve, nestquest-app Traefik
  router, verification) and the router priorities in section 3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/pwa/Dockerfile.dockerignore

@@ -0,0 +1,11 @@
+# Build-context filter for deploy/pwa/Dockerfile (BuildKit reads
+# <Dockerfile>.dockerignore in place of the root .dockerignore, which
+# excludes deploy/).  Only admin/ sources and nginx.conf enter the
+# build; local dependencies, build output and .env files never do.
+*
+!admin/
+!deploy/pwa/nginx.conf
+admin/node_modules
+admin/dist
+**/.env
+**/.env.*