fix: force LF line endings so containers start on Windows checkouts (#11)

Cloning on Windows with core.autocrlf=true converted
frontend/docker-entrypoint.d/20-basic-auth.sh to CRLF. Inside the container
the kernel read the shebang as /bin/sh\r, found no such interpreter, and
nginx crashed with exit 127 in a restart loop, so `docker compose up` never
produced a working web container.

- .gitattributes: LF for everything Linux executes or parses
- frontend/Dockerfile: sed strips CR at build time, covering checkouts made
  before .gitattributes existed

.gitattributes

@@ -0,0 +1,31 @@
+# Line ending normalisation.
+#
+# On Windows, git with core.autocrlf=true rewrites text files to CRLF on
+# checkout. For files executed inside the Linux containers that is fatal: the
+# shebang becomes "#!/bin/sh\r", the kernel looks for an interpreter literally
+# named "/bin/sh\r", fails to find it, and the container dies with exit 127
+# ("not found"). Keep the working tree on LF regardless of host OS.
+* text=auto eol=lf
+
+# Explicit — everything Linux executes or parses.
+*.sh        text eol=lf
+*.envsh     text eol=lf
+Dockerfile  text eol=lf
+*.conf      text eol=lf
+*.yml       text eol=lf
+*.yaml      text eol=lf
+*.ini       text eol=lf
+*.mako      text eol=lf
+.env.example text eol=lf
+.dockerignore text eol=lf
+
+# Leave binary assets alone.
+*.png  binary
+*.jpg  binary
+*.jpeg binary
+*.gif  binary
+*.ico  binary
+*.webp binary
+*.woff binary
+*.woff2 binary
+*.pdf  binary

frontend/Dockerfile

@@ -12,7 +12,12 @@ RUN apk add --no-cache openssl
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY docker-entrypoint.d/20-basic-auth.sh /docker-entrypoint.d/20-basic-auth.sh
-RUN chmod +x /docker-entrypoint.d/20-basic-auth.sh \
+# sed strips any stray CR: cloned on Windows with core.autocrlf=true the
+# script arrives as CRLF, the kernel reads the shebang as "/bin/sh\r", and
+# nginx dies on boot with "not found" (exit 127). .gitattributes fixes this
+# at the repository level; this line covers checkouts that predate it.
+RUN sed -i 's/\r$//' /docker-entrypoint.d/20-basic-auth.sh \
+    && chmod +x /docker-entrypoint.d/20-basic-auth.sh \
     && touch /etc/nginx/basic-auth.conf
 
 EXPOSE 80