Add SPA service block, runtime config override, README updates

- compose.yaml: new spa service. Image trm/spa:${SPA_TAG:-main}.
  expose: 80 (internal-only; reverse proxy fronts it). Read-only
  volume mount ${SPA_CONFIG_FILE:-./spa-config.json} ->
  /usr/share/nginx/html/config.json for the runtime-config override.
  Healthcheck via wget against localhost.
- spa-config.example.json: dev-default-equivalent file with env=stage.
  Operators copy to spa-config.json and edit per environment.
- .gitignore: spa-config.json never committed (per-environment).
- .env.example: new spa section documenting SPA_TAG and
  SPA_CONFIG_FILE; reframes the directus internal-only note as a
  shared design (SPA also internal-only).
- README.md:
  - Services in the stack: SPA moved from Planned to Currently.
  - Step 8 in first-deploy checklist: "Verify the SPA loads".
  - Network model: spell out the four routes the proxy must wire
    (/api, /ws-business, /ws-live, default -> SPA). Same-origin
    non-negotiable callout.
  - New "Runtime config override (SPA)" section: copy/edit/mount
    workflow + when not to use absolute URLs.

.env.example

@@ -106,6 +106,31 @@ DIRECTUS_CORS_ORIGIN=false
 # for local debugging.
 LOG_STYLE=json
 
+# ---------------------------------------------------------------------
+# spa (React front-end)
+# ---------------------------------------------------------------------
+
+# Image tag to pull. `main` auto-tracks the latest commit on the main branch.
+# In production, pin to a specific commit SHA for reproducibility.
+#   Example: SPA_TAG=ab12cd3
+SPA_TAG=main
+
+# Path on the host to the runtime config file. Mounted read-only into the
+# SPA container at /usr/share/nginx/html/config.json. Defaults to a sibling
+# file in this repo; create it from spa-config.example.json before first
+# deploy:
+#   cp spa-config.example.json spa-config.json
+#   # edit env to "stage" or "prod"; add googleMapsKey if operators have one
+# In Portainer, mount via a host-path volume that points at the file.
+SPA_CONFIG_FILE=./spa-config.json
+
+# Note: the SPA is intentionally NOT host-published. nginx serves the
+# bundle on port 80 inside the trm_default Compose network only,
+# reachable as `http://spa:80` from the same reverse proxy that fronts
+# directus. The proxy routes `/api` + `/ws-business` + `/ws-live` to the
+# backends and everything else to the SPA — same-origin is required for
+# the cookie-based auth flow to work end-to-end.
+
 # ---------------------------------------------------------------------
 # Shared
 # ---------------------------------------------------------------------