[KARLalpha4768]

Addresses SEC-04 and the Docker build findings.

• Root Dockerfile: PYTHONPATH and --app-dir point uvicorn at output/builds so src.api.twin_ws resolves.
• g++ step compiles only the C++ sources that exist (camera_driver.cpp and mount_control.cpp are not in the repo).
• docker-compose.yml and its generator docker_builder.py no longer mount /var/run/docker.sock into watchdog/updater; those services lose Docker-API restart/update and need an external mechanism.
• Adds health_check.py and config/site.json referenced by the build.

Verified (outside the Codex sandbox, Python 3.13.12 on Windows): python -m py_compile on every changed .py and node --check on every changed .js on this branch: 0 failures. pytest -q: 25 passed (baseline before changes: 25 passed). Secret scan: no hardcoded demo API key, Cesium-style JWT token, or postgres credentials remain once all five PRs are merged (each branch alone only removes its own items).

Not verified: docker build (Docker not available on the dev PC), terraform validate/plan, runtime/deployment tests. The existing tests do not exercise most changed code. Changes drafted with headless Codex and reviewed by hand.

One of five PRs splitting the HIGH findings from antigravity-findings-v2: fix/secrets-env, fix/api-nlp-lockdown, fix/docker-build, fix/infra-hardening, fix/correctness-high.