[BaaRai]

The bug

A fresh git clone of main cannot build the Docker image. The Dockerfile
copies a pre-built binary with COPY dist/${TARGETARCH}/artex /app/artex, but
dist/ is git-ignored, so a clean checkout has no such file and
docker compose up -d --build fails immediately with:

/dist/amd64/artex: not found

Commit 1ed154e made compose build locally (build: block + image: artex:local)
but left the Dockerfile still expecting the prebuilt binary, so the clean-clone
build stayed broken. This blocks anyone installing from git today.

The fix

Build the binary from source inside the image, as a multi-stage build:

• web stage (node:22-bookworm-slim, Node 22 matching CI/release): runs
  npm ci --ignore-scripts + npm run build:static to produce the frontend
  static export.
• build stage (golang:1.26-bookworm, matching go.mod and the release
  binaries job): copies the source and the frontend export into
  server/webui/dist, then runs build.sh with the same flags as the release
  binaries job (ARTEX_SKIP_FRONTEND=1, ARTEX_COMPRESS=0, -trimpath,
  -ldflags "-s -w -buildid= -X main.version=..."). The image binary and the
  published release binary therefore come from one build path.
• runtime stage: unchanged except the final binary now comes from
  COPY --from=build /out/artex /app/artex instead of the dist copy.

The Go build is CGO-free, so the web/build stages are pinned to
$BUILDPLATFORM and cross-compile to $TARGETARCH without QEMU. install.sh
loses its now-obsolete "no prebuilt binary under dist/" warning.

This is intentionally the smallest change that makes a clean clone build. It
does not touch release.yml, the recon-tool downloads, Node install method, bbot
or Playwright — those are out of scope here.

Verified

• docker compose -f docker-compose.yml config → exit 0, build block valid.
• build.sh driven with the exact build-stage env/flags skips the frontend step,
  parses --target linux/amd64, and reaches the Go compile at the configured
  output path (confirms the build-stage contract and COPY paths).
• bash -n on install.sh, update.sh, build.sh → OK.

NOT verified (environment limits, stated plainly)

• No real docker build was run. The available daemon could not reach the
  registry and the base images were not cached locally, so the image could not be
  built end-to-end here.
• go build ./... / go vet ./... could not complete offline (incomplete module
  cache, no network, and a Go 1.26.7-vs-1.26.10 toolchain gate in this
  environment). No Go source was changed by this PR.
• The frontend npm ci / build:static was not run (no network).

A maintainer should confirm one real docker compose up -d --build from a clean
clone before relying on this.

Why now / relationship to #127

This is urgent: a fresh clone of main cannot build the image today, so
anyone installing from git is blocked. We wrote this scoped fix in place of
waiting for the contributor's larger change in #127 (fix/docker-local-build-v2),
which is still a draft and conflicting with main.

This does not close or replace #127. #127 can be rebased on top of the new
main and keep the parts this PR deliberately did not touch (tool checksums,
GHCR publishing, sqlmap pinning), or closed by the maintainers once this lands —
your call.

Do not merge automatically; no auto-merge is enabled.