fix(webui): read REST API URL at runtime instead of build time

[GreicodexJM]

Problem

VUE_APP_RESTAPI_URL is read via process.env in LoginScreen.vue, which Vue CLI
inlines as a string literal at compile time. The REST API URL is therefore baked
into the JS bundle when the image is built.

The practical effect is that a published Dockerfile_WebUI image only ever works
against whatever host it was built for. It defaults to http://localhost:8080, so
anyone pulling a prebuilt WebUI image has to rebuild it from source just to point
the UI at their own server. That makes the WebUI image hard to distribute.

Change

Serve the value from a small config.js loaded before the app bundle, and
regenerate that file at container start from an environment variable.

• WebUI/public/config.js — sets window.__OPENAS2_CONFIG__
• WebUI/docker/40-openas2-config.sh — rewrites it from OPENAS2_RESTAPI_URL.
  Dropped into /docker-entrypoint.d/, which the official nginx image already
  sources, so no ENTRYPOINT override is needed.
• LoginScreen.vue — resolution order: runtime config → build-time
  VUE_APP_RESTAPI_URL → http://127.0.0.1:8443/api
• docker-compose.yml — build args become runtime environment

Default is http://localhost:8443/api, matching the compose REST API port.

Backwards compatible. The build arg still works and still wins over the
compiled default, so existing build pipelines are unaffected. The only behaviour
change is that OPENAS2_RESTAPI_URL, when set, takes precedence.

Verification

Built the image and ran it both ways:

$ docker run -d -p 8080:80 openas2-webui
$ curl -s localhost:8080/config.js
window.__OPENAS2_CONFIG__ = { restApiUrl: "http://localhost:8443/api" };

$ docker run -d -p 8080:80 -e OPENAS2_RESTAPI_URL=https://as2.example.org/api openas2-webui
$ curl -s localhost:8080/config.js
window.__OPENAS2_CONFIG__ = { restApiUrl: "https://as2.example.org/api" };

Also confirmed __OPENAS2_CONFIG__ is present in both the modern and legacy
compiled bundles, so the app actually reads it rather than the file merely being
served.

The change was additionally applied across the v4.1.0–v4.9.0 tags and built for
each; the anchors it touches are unchanged across that range.

Note

The URL is interpolated into a JS string literal, so the entrypoint escapes
backslashes and double quotes. It is an operator-supplied value, not user input.