Route all URLs to the front controller via FallbackResource

Bug: only / worked in the container; every other URL 404'd.

Cause: the previous Dockerfile used `sed` to retarget the docroot but
didn't touch the `<Directory>` block's `AllowOverride None`, so the
`public/.htaccess` rewrite rules were silently ignored. Apache served
`public/index.php` as the DirectoryIndex for `/`, but `/healthz`,
`/auth/login`, etc. hit the filesystem lookup first and returned 404
because no matching file exists.

Fix: stop editing the upstream config with sed. Write an explicit site
config that sets DocumentRoot to /var/www/html/public, opens
AllowOverride (so .htaccess can still add defense-in-depth rules in
non-Docker deployments), and uses `FallbackResource /index.php` so
every URL that doesn't resolve to a real file is dispatched by the
front controller. That drops the dependency on mod_rewrite for routing
(it's still loaded for anything .htaccess might use).

Rebuild the container: `docker compose build --no-cache && docker compose up`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -15,10 +15,25 @@ RUN composer install --no-dev --no-interaction --prefer-dist --no-progress
 
 COPY . .
 
+# Write a clean Apache site config pointing at public/ and routing every
+# unmatched URL to the front controller via FallbackResource. That replaces
+# the need for .htaccess rewrites (the .htaccess is kept as defense-in-depth
+# for deployments that don't use this image).
 RUN mkdir -p /var/www/data /var/www/data/sessions \
     && chown -R www-data:www-data /var/www/data \
-    && sed -ri 's!/var/www/html!/var/www/html/public!g' /etc/apache2/sites-available/000-default.conf \
-    && sed -ri 's!/var/www/!/var/www/html/public!g'   /etc/apache2/apache2.conf
+    && printf '%s\n' \
+        '<VirtualHost *:80>' \
+        '    DocumentRoot /var/www/html/public' \
+        '    <Directory /var/www/html/public>' \
+        '        Options -Indexes +FollowSymLinks' \
+        '        AllowOverride All' \
+        '        Require all granted' \
+        '        FallbackResource /index.php' \
+        '    </Directory>' \
+        '    ErrorLog ${APACHE_LOG_DIR}/error.log' \
+        '    CustomLog ${APACHE_LOG_DIR}/access.log combined' \
+        '</VirtualHost>' \
+        > /etc/apache2/sites-available/000-default.conf
 
 EXPOSE 80
 CMD ["apache2-foreground"]