fix(docker): single container (caddy+node), ESM adapters fix blank page

Docker: moved all docker files to docker/ tree (was conflated with
upstream Dockerfile at root + server/Dockerfile). Single container now:
caddy (front, serves static + proxies /api /ws) + node backend (internal
:4001). Node never exposed. entrypoint.sh runs both. Compose: one service.

Blank page root cause: storage adapters had inconsistent module systems.
firebase.js = ESM (export). ws.js + memory.js = CJS (module.exports).
CRA prod build = ESM strict -> CJS runtime crash, blank root. Dev mode
lenient, masked bug. First ws prod build (docker) = first exposure.
Never dev/prod split intended; just inconsistency from M2 era.

Fix: all adapters ESM. ws.js lazy-loads 'ws' pkg via dynamic import()
(Node/jest only; browser uses global WebSocket). index.js static
imports. server jest: added babel.config.js (preset-env, node target)
to transform ESM for jest.

Test: src/tests/StorageEsm.test.js — 4 tests grep all adapters for
module.exports / require(). Regression guard catches CJS leak.

Verified: docker page renders (root 4534 chars, UI visible).
server 24 green, shared 90 green, FE ESM 4 green.

src/tests/StorageEsm.test.js

@@ -0,0 +1,19 @@
+// Lock: storage adapters must use ESM exports (no module.exports).
+// Regression guard: CJS in src/ crashes CRA prod build (ESM strict).
+// Bug history: ws.js + memory.js used module.exports. Dev lenient (masked),
+// prod bundle crashed blank page. firebase.js always ESM.
+import fs from 'fs';
+import path from 'path';
+
+const ADAPTER_DIR = path.join(__dirname, '..', 'storage');
+
+describe('storage adapters use ESM (no CJS)', () => {
+  const adapters = ['ws.js', 'memory.js', 'firebase.js', 'index.js'];
+  test.each(adapters)('%s has no module.exports', (file) => {
+    const full = fs.readFileSync(path.join(ADAPTER_DIR, file), 'utf8');
+    // strip line comments so words like 'require' in explanatory comments don't trip the guard
+    const src = full.replace(/^\s*\/\/.*$/gm, '');
+    expect(src).not.toMatch(/module\.exports\s*=/);
+    expect(src).not.toMatch(/\brequire\s*\(/);
+  });
+});