fix: write the runtime config in the web image too

The Kubernetes deployment runs the split go-guess-web image, which is a plain
nginx serving static files and never ran an entrypoint. The theme service origin
is therefore never written into runtime-config.js there, so the page would always
read the empty default and theming would be silently inert in the cluster while
working in local runs. The combined root image already did this; the split one
now does too.

The script lives beside the frontend Dockerfile because that image's build
context is ./frontend, which cannot see docker/.

The chart passes THEME_BASE_URL to the web container rather than the API: it is
read by the browser, not by the service. It stays absent when unset, so a
deployment with no theme service renders exactly as before.

frontend/Dockerfile

@@ -8,5 +8,11 @@ RUN npm run build
 FROM nginx:1.29-alpine
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/dist /usr/share/nginx/html
+# Writes runtime-config.js from the environment on start, so one image serves
+# every environment instead of baking a hostname into the bundle at build time.
+# It lives beside this Dockerfile because the build context is ./frontend.
+COPY entrypoint.sh /usr/local/bin/go-guess-frontend-entrypoint
+RUN chmod +x /usr/local/bin/go-guess-frontend-entrypoint
 EXPOSE 80
+ENTRYPOINT ["/usr/local/bin/go-guess-frontend-entrypoint"]
 CMD ["nginx", "-g", "daemon off;"]

frontend/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# Writes the runtime configuration the page reads before the bundle runs, then
+# hands over to nginx.
+#
+# The front end is built once and served by many environments, so anything that
+# differs between them has to be resolved here rather than baked into the bundle.
+# Right now that is the origin of the theme service; an empty value leaves the
+# application on its own styling.
+set -eu
+
+CONFIG_DIR=/usr/share/nginx/html
+CONFIG_FILE="$CONFIG_DIR/runtime-config.js"
+
+# nginx serves its own error pages from this directory, so a read-only filesystem
+# would otherwise turn a missing file into a 500. The default is already in the
+# image, so this only replaces it.
+cat > "$CONFIG_FILE" <<CONFIG
+window.__GO_GUESS_CONFIG__ = { themeBaseUrl: "${THEME_BASE_URL:-}" }
+CONFIG
+
+exec "$@"