Harden Docker packaging and bundle frontend assets locally

- replace fragile Docker file bind mount with persistent /data storage
- add container entrypoint to link config.json from persistent storage
- tighten Docker image permissions and add a basic healthcheck
- add .dockerignore to keep git metadata and runtime files out of the image
- bundle hls.js locally instead of loading it from a CDN
- download and serve UI/theme fonts locally instead of Google Fonts
- update service worker cache entries for local assets
- refresh README to reflect local bundled assets and cleaner deployment docs

setup.php

@@ -109,7 +109,7 @@ $submitted_key   = trim($_POST['admin_key_input'] ?? $_POST['admin_key_hidden']
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>GridTV — Setup</title>
-<link href="https://fonts.googleapis.com/css2?family=Share+Tech+Mono&family=Barlow+Condensed:wght@300;400;600;700&display=swap" rel="stylesheet">
+<link rel="stylesheet" href="/assets/fonts/fonts.css">
 <style>
   :root {
     --bg:#0a0b0d;--surface:#111318;--surface2:#181b22;