Harden Docker packaging and bundle frontend assets locally

- replace fragile Docker file bind mount with persistent /data storage
- add container entrypoint to link config.json from persistent storage
- tighten Docker image permissions and add a basic healthcheck
- add .dockerignore to keep git metadata and runtime files out of the image
- bundle hls.js locally instead of loading it from a CDN
- download and serve UI/theme fonts locally instead of Google Fonts
- update service worker cache entries for local assets
- refresh README to reflect local bundled assets and cleaner deployment docs

themes/magazine.css

@@ -3,8 +3,6 @@
  * Papier jauni, encre rouge et bleue, machine à écrire.
  */
 
-@import url('https://fonts.googleapis.com/css2?family=Special+Elite&display=swap');
-
 :root {
   --bg: #f2e8c8;
   --surface: #ede0b0;