Enhance Docker setup and local development: bind database directory, update PHP server command, and add local dev router to prevent exposure of sensitive files

inc/db.php

@@ -11,12 +11,15 @@ function get_db(): PDO {
         return $pdo;
     }
 
-    $dbDir = __DIR__ . '/../db';
+    // In Docker, FITZ_DB_PATH points outside the web root (see
+    // docker-compose.yaml), so Apache can never serve the file. Local dev
+    // falls back to db/ in the project, which the dev router refuses to serve.
+    $dbPath = getenv('FITZ_DB_PATH') ?: __DIR__ . '/../db/fitz.sqlite';
+    $dbDir = dirname($dbPath);
     if (!is_dir($dbDir)) {
         mkdir($dbDir, 0755, true);
     }
 
-    $dbPath = $dbDir . '/fitz.sqlite';
     $isNew = !file_exists($dbPath);
 
     $pdo = new PDO('sqlite:' . $dbPath, null, null, [