Add docker compose deployment template

Multi-stage image built from the `web` extra only, so it carries no Qt: the
whole web path (webapp, web_session, metrics_json, and the shared analysis
modules) imports no Qt, pyqtgraph or matplotlib canvas. The build stage has the
compiler scipy/numba need; the runtime layer installs the built wheel, so the
same image works from a checkout or a release tarball.

Compose declares no audio volume on purpose. The app keeps no audio, so there is
nothing to persist: `read_only` plus a /tmp tmpfs means request spools are
memory-backed and never reach a disk. Publishing is loopback-only because the
tool has no authentication, and BLAS thread pools are pinned because analysis is
CPU-bound.

Fix three packaging bugs the build surfaced, each of which broke the image:

- `pip install --extra web` is not valid for a source tree; uv wants `.[web]`
  and failed with "Requesting extras requires a pylock.toml".
- The wheel shipped no static assets at all. `package-data` keys match
  *packages*, and the app modules are top-level `py-modules`, so the `"*"` key
  matched nothing - verified by inspecting the built wheel: 14 .py files, zero
  HTML/JS/CSS. An installed `ujm-web` would have 404'd every asset. `static/` is
  now declared a package (hence its packaging-shim `__init__.py`) so the assets
  install next to the modules, which is where `webapp.py` looks for them.
- The Dockerfile's curated COPY list omitted modules that `py-modules` requires,
  failing the build with "file <module>.py not found". It copies the checkout,
  filtered by .dockerignore.

Move PyQt5/pyqtgraph into a `desktop` extra so the web install is genuinely
Qt-free. Verified: `find` for Qt in a web-only venv now returns nothing, and the
desktop path still resolves and imports.

Add scripts/make_fixtures.py so the smoke suite has no network or ffmpeg
dependency (the tagged MP3 is optional and its assertions skip when absent), and
make the suite tolerate that. Verified against the *installed package* running
the container's own command line, from a directory with no source tree:
61/61 passing.

Also correct README claims that had gone stale: BPM (removed), the matplotlib
canvas (replaced by pyqtgraph), and font_control_widget.py (deleted).

docker-compose.yml

@@ -0,0 +1,88 @@
+# uj-mastering-master — web UI, container deployment template.
+#
+#   docker compose up --build        # build and start
+#   docker compose logs -f           # watch startup
+#   open http://localhost:8000
+#
+# There is deliberately no audio volume. Uploaded audio lives in the browser
+# (Origin Private File System) and each request body is spooled to /tmp only
+# while that request is being decoded. Nothing about a user's masters is
+# persisted here — read-only storage is not just possible, it is the intent.
+
+services:
+  ujm-web:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      # Pin the build to this branch's source; override to build from a
+      # release tag instead:
+      #   docker compose build --build-arg ...
+    image: uj-mastering-master-web:local
+    container_name: ujm-web
+
+    # Loopback-only by default. The app binds 0.0.0.0 *inside* the container,
+    # but publishing to 127.0.0.1 means it is only reachable from this host —
+    # an analysis tool with no authentication should not appear on the LAN by
+    # accident. Change to "8000:8000" (or put it behind a reverse proxy) to
+    # expose it deliberately.
+    ports:
+      - "127.0.0.1:8000:8000"
+
+    environment:
+      # Analysis is CPU-bound numpy/scipy; keep BLAS from oversubscribing when
+      # several requests overlap. Raise these if you raise `cpus` below.
+      OMP_NUM_THREADS: "4"
+      OPENBLAS_NUM_THREADS: "4"
+      MKL_NUM_THREADS: "4"
+      NUMEXPR_NUM_THREADS: "4"
+      # Writable scratch for numba/matplotlib caches and request spools.
+      NUMBA_CACHE_DIR: /tmp/numba-cache
+      MPLCONFIGDIR: /tmp/matplotlib
+      TMPDIR: /tmp
+
+    # The container filesystem can be read-only: the app writes nothing it
+    # needs to keep. /tmp is a tmpfs (memory-backed) so spooled request bodies
+    # never touch a disk at all.
+    read_only: true
+    tmpfs:
+      - /tmp:size=1g,mode=1777
+
+    # Analysis needs headroom: a long master at native sample rate is heavy in
+    # RAM. Raise the limit for large files; the tmpfs above is also backed by
+    # memory, so --memory must comfortably exceed it.
+    deploy:
+      resources:
+        limits:
+          cpus: "4.0"
+          memory: 4g
+
+    # Run as the image's unprivileged user (uid 10001). Nothing here needs root.
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+    restart: unless-stopped
+    stop_grace_period: 10s
+
+    # The image ships a HEALTHCHECK; this is the same check expressed at the
+    # orchestration layer, so `docker compose ps` shows real health.
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/metrics', timeout=4).status == 200 else 1)"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+# No volumes are declared, on purpose. If you want to run the API smoke test
+# inside the image, do it ad hoc rather than mounting a source tree:
+#
+#   docker compose exec ujm-web python - <<'PY'
+#   ...                        # or see `make smoke` in the README
+#   PY