feat: add Docker watch mode for dynamic container sessions

- Add --docker-watch CLI flag to watch for containers with webterm-command label
- Containers with label 'auto' get bash exec, otherwise use label as command
- Dynamic dashboard updates via SSE when containers start/stop
- Add /tiles endpoint for JSON tile list
- Multi-stage Dockerfile for minimal production image
- Update README with docker-watch documentation

The docker watcher monitors Docker events and automatically:
- Adds terminal tiles when labeled containers start
- Removes tiles when containers stop
- Notifies dashboard via SSE for live updates

Dockerfile

@@ -1,19 +1,41 @@
-# Minimal image for serving a web terminal
-FROM python:3.12-slim
+# Minimal image for serving a web terminal with Docker watch mode
+#
+# Build: docker build -t textual-webterm .
+# Run:   docker run -v /var/run/docker.sock:/var/run/docker.sock -p 8080:8080 textual-webterm --docker-watch
+#
+FROM python:3.12-slim AS builder
 
-# Install minimal dependencies
+# Install build dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     make \
     && rm -rf /var/lib/apt/lists/*
 
-# Install textual-webterm
-COPY . /app
-WORKDIR /app
-RUN make install
+# Copy only what's needed for installation
+WORKDIR /build
+COPY pyproject.toml poetry.lock* ./
+COPY src/ ./src/
+COPY Makefile ./
+
+# Install the package
+RUN pip install --no-cache-dir .
+
+# Final minimal image
+FROM python:3.12-slim
+
+# Install only runtime dependencies (docker CLI for exec commands)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    docker.io \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy installed packages from builder
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin/textual-webterm /usr/local/bin/textual-webterm
+
+# Create non-root user (optional, but may need root for Docker socket access)
+# RUN useradd -m webterm
+# USER webterm
 
-# Expose the default port
 EXPOSE 8080
 
-# Run the terminal server
 ENTRYPOINT ["textual-webterm"]
-CMD ["--host", "0.0.0.0", "--port", "8080"]
+CMD ["--host", "0.0.0.0", "--port", "8080", "--docker-watch"]