fix: write the runtime config in the web image too

The Kubernetes deployment runs the split go-guess-web image, which is a plain
nginx serving static files and never ran an entrypoint. The theme service origin
is therefore never written into runtime-config.js there, so the page would always
read the empty default and theming would be silently inert in the cluster while
working in local runs. The combined root image already did this; the split one
now does too.

The script lives beside the frontend Dockerfile because that image's build
context is ./frontend, which cannot see docker/.

The chart passes THEME_BASE_URL to the web container rather than the API: it is
read by the browser, not by the service. It stays absent when unset, so a
deployment with no theme service renders exactly as before.

frontend/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# Writes the runtime configuration the page reads before the bundle runs, then
+# hands over to nginx.
+#
+# The front end is built once and served by many environments, so anything that
+# differs between them has to be resolved here rather than baked into the bundle.
+# Right now that is the origin of the theme service; an empty value leaves the
+# application on its own styling.
+set -eu
+
+CONFIG_DIR=/usr/share/nginx/html
+CONFIG_FILE="$CONFIG_DIR/runtime-config.js"
+
+# nginx serves its own error pages from this directory, so a read-only filesystem
+# would otherwise turn a missing file into a 500. The default is already in the
+# image, so this only replaces it.
+cat > "$CONFIG_FILE" <<CONFIG
+window.__GO_GUESS_CONFIG__ = { themeBaseUrl: "${THEME_BASE_URL:-}" }
+CONFIG
+
+exec "$@"