docker: run the server in compose

[aberoham]

Adds docker/Dockerfile and docker/entrypoint.sh so the server runs as a container against a remote API, and makes plain HTTP a supported mode rather than an accident.

The entrypoint writes etc/nictool.json from the environment on first start and never replaces an operator's existing file. NICTOOL_TLS=false skips cert discovery and generation and serves over HTTP on NICTOOL_HTTP_PORT; NICTOOL_BIND_HOST sets the listen address, without which the server binds the container hostname and port forwarding never reaches it. api.scheme in the bootstrap config lets an internal host like api be reached over http — the old heuristic assumed https for anything that wasn't localhost.

$ curl localhost:8080/nt/service
{"api":{"running":true,"mode":"remote"}}
$ curl -o /dev/null -w '%{http_code}' localhost:8080/api/documentation
200

node --test: 193 pass, 0 fail, 0 skipped, with bind9-utils and openssl present as the Dockerfile installs them.

Supersedes #3, which predates nictool.toml becoming nictool.json.