fix(docker): move Dockerfile to docker/ to prevent Railway auto-detection (#1334)

Railway auto-detects Dockerfiles at repo root and uses them for ALL
services, even those set to NIXPACKS. This caused all seed services
(ais-relay, seed-gpsjam, etc.) to build nginx-only containers with
no node binary, breaking every Railway service.

Move Dockerfile and related files to docker/ subdirectory. Railway
only checks the repo root for Dockerfiles, so this prevents
accidental detection. GHA workflow updated with explicit file: path.

.github/workflows/docker-publish.yml

@@ -38,6 +38,7 @@ jobs:
       - uses: docker/build-push-action@v6
         with:
           context: .
+          file: docker/Dockerfile
           push: true
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}

README.md

@@ -404,7 +404,7 @@ The image is **frontend-only**: it serves the Vite-built static app with nginx a
 **Build (from repo root):**
 
 ```bash
-docker build -t ghcr.io/koala73/worldmonitor:latest .
+docker build -f docker/Dockerfile -t ghcr.io/koala73/worldmonitor:latest .
 ```
 
 **Run (default API: `https://api.worldmonitor.app`):**

docker/Dockerfile

@@ -35,9 +35,9 @@ ENV API_UPSTREAM=https://api.worldmonitor.app
 
 # Copy built assets, nginx template (API_UPSTREAM substituted at startup), and entrypoint.
 COPY --from=builder /app/dist/ ./
-COPY nginx.conf.template /etc/nginx/nginx.conf.template
+COPY docker/nginx.conf.template /etc/nginx/nginx.conf.template
-COPY nginx-security-headers.conf /etc/nginx/security_headers.conf
+COPY docker/nginx-security-headers.conf /etc/nginx/security_headers.conf
-COPY docker-entrypoint.sh /docker-entrypoint.sh
+COPY docker/docker-entrypoint.sh /docker-entrypoint.sh
 RUN chmod +x /docker-entrypoint.sh
 
 EXPOSE 80