refactor: move Docker build files to web-app directory

Moved Dockerfile, build.sh, and .dockerignore to web-app/ for better
project encapsulation. Each project now contains its own build configuration.

## Changes
- Moved Dockerfile to web-app/ and simplified paths
- Moved build.sh to web-app/
- Moved .dockerignore to web-app/
- Updated Dockerfile to work from web-app/ context (no workspace references)
- Updated documentation for new build workflow

## Build Workflow
- Build: Run from web-app/ directory (`cd web-app && ./build.sh 2.20.0`)
- Deploy: Run from repository root (`./deploy-standalone.sh 2.20.0`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

web-app/Dockerfile

@@ -0,0 +1,54 @@
+# This file is inspired by https://github.com/vercel/next.js/blob/canary/examples/with-docker/Dockerfile
+
+FROM node:24-alpine AS base
+
+#-----------------------------------------
+# STAGE 1: Build the Next.js project
+#-----------------------------------------
+FROM base AS builder
+
+# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
+RUN apk add --no-cache libc6-compat
+
+WORKDIR /app
+
+# Copy package files
+COPY ./package.json ./package-lock.json ./
+
+# Install dependencies
+RUN npm i && npm cache clean --force
+
+# Copy application source code
+COPY . .
+
+# Build application
+RUN npm run build
+
+#-----------------------------------------
+# STAGE 3: Run the Next.js server
+#-----------------------------------------
+FROM gcr.io/distroless/nodejs20-debian12:nonroot AS production
+
+WORKDIR /app
+
+# making sure the production server does not use mock auth
+ENV NODE_ENV=production
+
+COPY --from=builder /app/public/* /app/public/
+# this file is required for the pdfjs-dist package
+COPY --from=builder /app/node_modules/pdfjs-dist/build/pdf.worker.min.mjs /app/public/pdf.worker.min.mjs
+
+# Automatically leverage output traces to reduce image size
+# https://nextjs.org/docs/advanced-features/output-file-tracing
+COPY --from=builder --chown=nonroot:nonroot /app/.next/standalone ./
+COPY --from=builder --chown=nonroot:nonroot /app/.next/static ./.next/static
+
+USER nonroot
+
+EXPOSE 3000
+
+ENV PORT=3000
+
+# server.js is created by next build from the standalone output
+# https://nextjs.org/docs/pages/api-reference/next-config-js/output
+CMD ["server.js"]