feat(waiter): venue servers publish the native UI bundle (manifest + zip)

- scripts/pack-bundle.mjs zips dist-native deterministically (sorted paths,
  fixed mtimes) into dist/downloads/waiter-bundle-<hash>.zip and writes
  waiter-bundle.json {format, version "<APP_VERSION>-<hash12>", file,
  sha256 (hex), size, min_shell_build, app_version, built_at}
- src/native/shell.js: MIN_SHELL_BUILD - lowest APK versionCode a bundle
  runs in (bump with native changes)
- Dockerfile: node 22; builds web + native bundle + pack (APP_VERSION build
  arg, from ${VERSION} in docker-compose.dev.yml)
- vite native mode strips public/downloads from dist-native - the 10.8 MB
  APK was being copied into the native build (and would have ended up inside
  the next APK); bundle 15 MB → 5 MB
- nginx /downloads/: json/zip types, CORS * (the app reads the manifest from
  origin http://localhost), no-cache
- .dockerignore: android/, releases/, dist-native/ out of the build context

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

waiter_pwa/Dockerfile

@@ -1,4 +1,7 @@
-FROM node:20-slim AS builder
+FROM node:22-slim AS builder
+
+# Shown in the UI bundle manifest (plan step 8); the bundle's identity is its content hash
+ARG APP_VERSION=0.0.0
 
 WORKDIR /app
 
@@ -6,7 +9,9 @@ COPY package.json package-lock.json* ./
 RUN npm install --legacy-peer-deps
 
 COPY . .
-RUN npm run build
+# Web build (served to browsers) + native UI bundle that phones download from
+# this server: dist/downloads/waiter-bundle.json + waiter-bundle-<hash>.zip
+RUN npm run build  && npx vite build --mode native  && APP_VERSION=$APP_VERSION node scripts/pack-bundle.mjs
 
 FROM nginx:alpine