deploy: add Dockerfile + nginx config for static hosting

The web/ directory is fully self-contained (index.html + worklet.js, all JS
deps pulled from esm.sh via the importmap). Package it as a tiny nginx:alpine
image so Coolify can build + serve it behind Caddy.

- Dockerfile: nginx:1.27-alpine, copies web/ to the document root, healthcheck.
- nginx.conf: serves /, no-cache for index.html and worklet.js (so engine
  changes land immediately after a redeploy), short cache for everything else,
  gzip on text payloads, JS MIME for AudioWorklet.
- .dockerignore: keep the image small (excludes Python sources, docs,
  references, sandbox is included since it's served from /sandbox/).

nginx.conf

@@ -0,0 +1,39 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # AudioWorkletProcessor needs the worklet served as a real JS module.
+    types {
+        application/javascript js;
+        text/html              html;
+        text/css               css;
+        image/svg+xml          svg;
+    }
+
+    # Static index — short cache so updates land quickly after a redeploy.
+    location = / {
+        try_files /index.html =404;
+        add_header Cache-Control "no-cache, must-revalidate";
+    }
+    location = /index.html {
+        add_header Cache-Control "no-cache, must-revalidate";
+    }
+
+    # Worklet: revalidate on every load (it changes whenever we touch the engine).
+    location = /worklet.js {
+        add_header Cache-Control "no-cache, must-revalidate";
+    }
+
+    # Everything else (sandbox/, future static assets) gets a moderate cache.
+    location / {
+        try_files $uri $uri/ =404;
+        add_header Cache-Control "public, max-age=300";
+    }
+
+    # Gzip the text payloads.
+    gzip on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+    gzip_min_length 256;
+}