feat(docker): add all-in-one Dockerfile without Playwright (<200MB target)

Multi-stage build:
- Stage 1: node:20-alpine builds frontend (discarded)
- Stage 2: python:3.11-slim runs backend + serves SPA static files
- Playwright removed from deps (saves ~350MB)
- Uvicorn serves both API and frontend on :8000
- Healthcheck via curl
- Entrypoint with admin bootstrap support

Estimated image size: ~190MB (vs ~550MB with playwright)

docker/all-in-one.Dockerfile

@@ -0,0 +1,64 @@
+# ============================================================
+# All-in-One Docker image (no Playwright, <200MB target)
+# ============================================================
+# Build:  docker build -f docker/all-in-one.Dockerfile -t ss-tools:latest .
+# Run:    docker run -p 8000:8000 --env-file backend/.env ss-tools:latest
+#
+# Stages:
+#   1. frontend-builder — node:20-alpine, npm ci + build, discarded
+#   2. runtime — python:3.11-slim, backend deps (no playwright),
+#      copies frontend build, uvicorn serves both SPA + API on :8000
+
+# ── Stage 1: Build Frontend ────────────────────────────────
+FROM node:20-alpine AS frontend-builder
+
+WORKDIR /app/frontend
+
+# Install deps (layer cache when package.json unchanged)
+COPY frontend/package.json frontend/package-lock.json* ./
+RUN npm ci --prefer-offline --no-audit --no-fund
+
+# Build frontend
+COPY frontend/ ./
+RUN npm run build
+
+# ── Stage 2: Runtime ───────────────────────────────────────
+FROM python:3.11-slim AS runtime
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    BACKEND_PORT=8000 \
+    DEBIAN_FRONTEND=noninteractive
+
+WORKDIR /app
+
+# System deps (git for GitPython, curl for healthcheck)
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        curl \
+        git \
+    && rm -rf /var/lib/apt/lists/*
+
+# Python deps (NO playwright — saves ~350MB)
+COPY backend/requirements-docker.txt /app/backend/requirements-docker.txt
+RUN pip install --no-cache-dir -r /app/backend/requirements-docker.txt
+
+# Backend source
+COPY backend/ /app/backend/
+
+# Frontend build (from stage 1)
+COPY --from=frontend-builder /app/frontend/build /app/frontend/build
+
+# Entrypoint
+COPY docker/backend.entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
+
+WORKDIR /app/backend
+
+EXPOSE 8000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD curl -sf http://localhost:8000/ || exit 1
+
+ENTRYPOINT ["/app/entrypoint.sh"]
+CMD ["python", "-m", "uvicorn", "src.app:app", "--host", "0.0.0.0", "--port", "8000"]