Deploy the web app: derive the API base from the origin, add a Dockerfile

Deploy the web app: derive the API base from the origin, add a Dockerfile DEFAULT_BASE now derives ${location.origin}/__api in the browser instead of the hard-coded 127.0.0.1:8099, so a fresh visitor and unauthenticated share recipients reach the API with no configuration (closes the frontend API-origin gap). Adds web/Dockerfile (adapter-node, built from the repo root so the /tour route's docs/ imports resolve; node:24-slim because rolldown has no musl binding) and web/.dockerignore so the host node_modules does not clobber the container's.