fix(docker): fix TDZ crash, icon bundle bloat, rate-limit on static assets

- Fix "Cannot access 'a' before initialization" TDZ error after login
  caused by manualChunks splitting react-vendor + lucide icons into
  circular ES-module chunks. Removed manualChunks entirely.

- Replace `import * as icons from "lucide-react"` (pulls all ~1000 icons)
  with a targeted icon-map of ~50 icons actually used by tool definitions.
  Reduces shared icons chunk from 745KB to 62KB (132KB→16KB gzip).

- Exclude static files from @fastify/rate-limit via allowList so rapid
  page navigations don't 429 on JS/CSS chunk requests.

- Move Docker auth defaults (AUTH_ENABLED, DEFAULT_USERNAME,
  DEFAULT_PASSWORD) from Dockerfile ENV to entrypoint.sh runtime exports
  to avoid SecretsUsedInArgOrEnv warnings.

- Fix Docker CMD to use pnpm --filter for workspace-scoped tsx binary.

- Set COREPACK_HOME system-wide so non-root user can access pnpm cache.

- Lazy-load all pages in App.tsx and all controls in
  pipeline-step-settings.tsx to keep main bundle under 300KB.

docker/entrypoint.sh

@@ -1,6 +1,12 @@
 #!/bin/sh
 set -e
 
+# Apply auth defaults at runtime so they are never baked into image layers.
+# Users can override any of these via -e flags at docker run time.
+export AUTH_ENABLED="${AUTH_ENABLED:-true}"
+export DEFAULT_USERNAME="${DEFAULT_USERNAME:-admin}"
+export DEFAULT_PASSWORD="${DEFAULT_PASSWORD:-admin}"
+
 # Fix ownership of mounted volumes so the non-root ashim user can write.
 # This runs as root, fixes permissions, then drops to ashim via gosu.
 if [ "$(id -u)" = "0" ]; then