feat(waiter): venue servers publish the native UI bundle (manifest + zip)

- scripts/pack-bundle.mjs zips dist-native deterministically (sorted paths,
  fixed mtimes) into dist/downloads/waiter-bundle-<hash>.zip and writes
  waiter-bundle.json {format, version "<APP_VERSION>-<hash12>", file,
  sha256 (hex), size, min_shell_build, app_version, built_at}
- src/native/shell.js: MIN_SHELL_BUILD - lowest APK versionCode a bundle
  runs in (bump with native changes)
- Dockerfile: node 22; builds web + native bundle + pack (APP_VERSION build
  arg, from ${VERSION} in docker-compose.dev.yml)
- vite native mode strips public/downloads from dist-native - the 10.8 MB
  APK was being copied into the native build (and would have ended up inside
  the next APK); bundle 15 MB → 5 MB
- nginx /downloads/: json/zip types, CORS * (the app reads the manifest from
  origin http://localhost), no-cache
- .dockerignore: android/, releases/, dist-native/ out of the build context

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

waiter_pwa/nginx.conf

@@ -27,9 +27,17 @@ server {
 
     # Native app APK for sideloading (bundled by scripts/build-apk.mjs release).
     # Real 404 when absent - never fall through to index.html.
+    # Also the per-venue UI bundle for the native app (plan step 8):
+    # waiter-bundle.json (manifest, never cached) + waiter-bundle-<hash>.zip.
     location /downloads/ {
-        types { application/vnd.android.package-archive apk; }
+        types {
+            application/vnd.android.package-archive apk;
+            application/json                        json;
+            application/zip                         zip;
+        }
         add_header Cache-Control "no-cache";
+        # The native app (origin http://localhost) reads the manifest via fetch
+        add_header Access-Control-Allow-Origin "*";
         try_files $uri =404;
     }