Add optional Docker setup for local development

[zivkovicp]

This PR adds an optional Docker-based development setup, updates README documentation with usage instructions, and introduces minimal environment-variable configuration required to support local development when the frontend and backend are not served from the same origin.

To enable this, the PR includes small, targeted updates to proxy and middleware behavior (including WebSocket proxying) so that CORS-related assumptions are configurable rather than hard-coded.

The existing install and usage flow remains fully supported and unchanged by default.

[zxrys]

Thanks for the Docker support work! I tested this branch and found a few issues that should be addressed before merge:

1. Laboratory page fails in Docker with WebSocket connection error!
   The Docker setup starts correctly, but in Laboratory/Batch Run the WebSocket URL logic still depends on VITE_API_BASE_URL (for example http://backend:6400), which is not resolvable from the browser on host.
   Please align this page with the Launch page strategy (same-origin + /ws via Vite proxy in dev / nginx in prod).

2. Security-related middleware changes: optional, but need cleanup if kept
   Since this project is currently focused on local deployment, you may consider removing the server-security hardening changes from this PR to keep scope smaller.
   If you want to keep them, please fix the middleware design issue: CORS is currently registered twice (in server/bootstrap.py and utils/middleware.py), which can cause policy conflicts and unclear behavior. We should keep a single CORS source of truth.

3. Please include uv.lock in Docker build for reproducibility
   Right now dependencies are installed without lockfile pinning.
   Please copy/use uv.lock in the image build so dependency resolution is deterministic.

4. Please sync with latest main README updates and resolve conflicts
   main has changed and this PR now conflicts with README updates.
   Please rebase/merge from main and update README/README-zh accordingly.

Also, because we are not planning server deployment right now, it would be best to keep this PR focused on local Docker development behavior.