feat: serve the UI from the backend image, one-port standalone stack

The backend image builds the web UI with scripts/build_frontend.sh and
serves it through docsgpt/ui.py, so the standalone Compose file drops the
frontend container. UI and API share port 7091, published on 127.0.0.1
unless DOCSGPT_BIND says otherwise. POSTGRES_PASSWORD is configurable, and
an optional https profile puts Caddy in front of a public domain.

docker-image-verify.yml starts the standalone stack on the image it built
and checks the API, the UI, /config.js and a client-side route on one port.

docs/content/Deploying/Air-Gapped.mdx

@@ -39,13 +39,14 @@ On a machine with internet access, pull the images and save them to one file:
 ```bash
 TAG=latest   # or a release, e.g. 0.19.0
 docker pull arc53/docsgpt:$TAG
-docker pull arc53/docsgpt-fe:$TAG
 docker pull redis:6-alpine
 docker pull postgres:16-alpine
 docker save -o docsgpt-images.tar \
-  arc53/docsgpt:$TAG arc53/docsgpt-fe:$TAG redis:6-alpine postgres:16-alpine
+  arc53/docsgpt:$TAG redis:6-alpine postgres:16-alpine
 ```
 
+The backend image serves the web UI too, so the standalone stack needs no frontend image. Add `arc53/docsgpt-fe:$TAG` only if you run the checkout Compose files or Kubernetes, which use it.
+
 Copy `docsgpt-images.tar` and the [standalone Compose file](/Deploying/Docker-Deploying#quickest-setup-pre-built-images-no-checkout) into the air-gapped network, then load the images (or push them to your internal registry):
 
 ```bash

docs/content/Deploying/Docker-Deploying.mdx

@@ -21,10 +21,13 @@ Docker is the recommended method for deploying DocsGPT, providing a consistent a
 
 Every release publishes ready-to-run images to Docker Hub (`arc53/docsgpt`,
 `arc53/docsgpt-fe`) and GitHub Container Registry (`ghcr.io/arc53/docsgpt`,
-`ghcr.io/arc53/docsgpt-fe`) for `linux/amd64` and `linux/arm64`. The images
-contain everything the default configuration needs (embedding models,
-tokenizers, tiktoken's encoding), so a fresh container makes no downloads on
-first use. You do not need the source tree to run them:
+`ghcr.io/arc53/docsgpt-fe`) for `linux/amd64` and `linux/arm64`.
+`arc53/docsgpt` runs the API, serves the web UI and runs the worker;
+`arc53/docsgpt-fe` is the separate frontend image the checkout Compose files
+and Kubernetes use. The images contain everything the default configuration
+needs (embedding models, tokenizers, tiktoken's encoding), so a fresh
+container makes no downloads on first use. You do not need the source tree to
+run them:
 
 1.  **Download the standalone Compose file** (also attached to every
     [release](https://github.com/arc53/DocsGPT/releases)):
@@ -52,7 +55,9 @@ first use. You do not need the source tree to run them:
     docker compose -f docker-compose-standalone.yaml up -d
     ```
 
-    Then open [http://localhost:5173/](http://localhost:5173/). Data lives in
+    Then open [http://localhost:7091/](http://localhost:7091/). The web UI and
+    the API share that port, which is published on `127.0.0.1`: only this
+    machine can reach it until you change `DOCSGPT_BIND` (below). Data lives in
     named Docker volumes; `docker compose -f docker-compose-standalone.yaml down`
     keeps it and `down -v` removes it.
 
@@ -66,6 +71,77 @@ the shell, e.g. `DOCSGPT_IMAGE_TAG=0.20.0 DOCSGPT_IMAGE_VARIANT=-docling`.
 The same two variables drive `deployment/docker-compose-hub.yaml` in a
 checkout.
 
+### Opening it from other machines
+
+Publish the port on every interface and turn on authentication in `.env`:
+
+```bash
+DOCSGPT_BIND=0.0.0.0
+AUTH_TYPE=simple_jwt
+JWT_SECRET_KEY=<a long random value, e.g. openssl rand -hex 32>
+```
+
+Then run `docker compose -f docker-compose-standalone.yaml up -d` again. The UI
+takes its API address from the page it was loaded from, so
+`http://<server-address>:7091/` works without further settings. Without
+`AUTH_TYPE`, anyone who can reach the port can use DocsGPT.
+
+With `simple_jwt` the UI asks for a token, which the backend prints when it
+starts: `docker compose -f docker-compose-standalone.yaml logs backend | grep "Simple JWT"`.
+The token is signed with `JWT_SECRET_KEY`. Without that setting each container
+generates its own secret, and a re-created container (after `pull` or a
+settings change) gets a new one and so a new token. Over plain HTTP the token
+travels as readable text; outside a trusted network, use HTTPS as below.
+`DOCSGPT_PORT` changes the host port (default `7091`). See
+[Authentication Settings](/Deploying/DocsGPT-Settings#authentication-settings) for the other modes.
+
+### HTTPS with your own domain
+
+The Compose file has an optional Caddy service that obtains and renews a
+Let's Encrypt certificate and proxies to the backend.
+
+1.  Point the domain's DNS records at the machine and open ports 80 and 443.
+2.  Add to `.env`:
+
+    ```bash
+    COMPOSE_PROFILES=https
+    DOCSGPT_DOMAIN=docs.example.com
+    AUTH_TYPE=simple_jwt
+    JWT_SECRET_KEY=<a long random value, e.g. openssl rand -hex 32>
+    ```
+
+3.  Run `docker compose -f docker-compose-standalone.yaml up -d` and open
+    `https://docs.example.com/`.
+
+`COMPOSE_PROFILES=https` in `.env` makes every later `up`, `down` and `logs`
+include Caddy. Leave `DOCSGPT_BIND` at its default: Caddy reaches the backend
+over the Compose network.
+
+### Database password
+
+The Postgres password defaults to `docsgpt`; the database is only reachable
+inside the Compose network. To use your own, set `POSTGRES_PASSWORD` in `.env`
+before the first start, with URL-safe characters (e.g. `openssl rand -hex 24`).
+Postgres reads it only when its volume is created, so changing it later does
+not change the existing database's password.
+
+### Upgrading from an earlier standalone file
+
+Before this change the standalone file ran a separate frontend container on
+port 5173 and published both ports on every interface. After downloading the
+new file:
+
+```bash
+docker compose -f docker-compose-standalone.yaml pull
+docker compose -f docker-compose-standalone.yaml up -d --remove-orphans
+```
+
+`--remove-orphans` removes the old frontend container. Open port 7091 instead
+of 5173. Your data volumes are unchanged. If you opened DocsGPT from other
+machines, follow [Opening it from other machines](#opening-it-from-other-machines),
+and remove `VITE_API_HOST` from `.env` if it points at `localhost`: the UI
+would otherwise keep calling the visitor's own machine.
+
 ## Using the Source Checkout
 
 With a clone of the repository, `deployment/docker-compose-hub.yaml` runs the

docs/content/changelog.mdx

@@ -11,6 +11,20 @@ The notable changes in each release. Every release on GitHub also carries
 [auto-generated notes](https://github.com/arc53/DocsGPT/releases) listing every merged pull
 request, and [Upgrading](/upgrading) covers the steps an existing deployment has to take.
 
+## Unreleased
+
+### The standalone Docker stack runs on one port
+
+The `arc53/docsgpt` image now serves the web UI next to the API, the way `docsgpt api` does from
+the Python package. `docker-compose-standalone.yaml` no longer runs a frontend container: the UI
+and the API share port 7091, published on `127.0.0.1` by default. The UI takes its API address
+from the page it was loaded from, so opening the stack from another machine works without
+setting `VITE_API_HOST`. New Compose settings: `DOCSGPT_BIND` and `DOCSGPT_PORT` for where the
+port is published, `POSTGRES_PASSWORD`, and an `https` profile that puts Caddy with an automatic
+certificate in front of a public domain. The `arc53/docsgpt-fe` image is still published for the
+checkout Compose files and Kubernetes. See
+[Upgrading from an earlier standalone file](/Deploying/Docker-Deploying#upgrading-from-an-earlier-standalone-file).
+
 ## 0.20.0
 
 ### DocsGPT installs from PyPI

docs/content/upgrading.mdx

@@ -11,6 +11,10 @@ import { Callout } from 'nextra/components'
   **Upgrading from 0.16.x?** User data moved from MongoDB to Postgres in 0.17.0. Follow the [Postgres Migration guide](/Deploying/Postgres-Migration) before running `docker compose pull` or `git pull` — existing deployments will not start cleanly without it.
 </Callout>
 
+## Standalone Compose file: one port
+
+The standalone Compose file (`docker-compose-standalone.yaml`) no longer runs a frontend container. The backend image serves the web UI on port 7091, and the port is published on `127.0.0.1` unless you set `DOCSGPT_BIND`. After downloading the new file, start it with `--remove-orphans` to remove the old frontend container, then open port 7091 instead of 5173. If you opened DocsGPT from other machines, see [Upgrading from an earlier standalone file](/Deploying/Docker-Deploying#upgrading-from-an-earlier-standalone-file). The checkout Compose files and the Kubernetes manifests are unchanged.
+
 ## Embedding models
 
 DocsGPT now runs embeddings through [FastEmbed](https://github.com/qdrant/fastembed) (ONNX Runtime) instead of SentenceTransformer. The models are the same and the vectors are identical, so **your existing index needs no action** — `all-mpnet-base-v2` keeps working exactly as before.