Major improvements: multi-stage Docker, security hardening, host metrics, tests

- Multi-stage Docker build: Dockerfile compiles frontend (Node.js) and
  backend (Gradle) inside Docker; no local Java/Node.js required
- Security hardening: replaced full host root mount with specific
  directory mounts (/proc, /sys, /etc, /var, /home, /opt, /tmp, /srv, /usr)
- Host metrics consistency: LinuxMemoryService and CpuDetailsService now
  read from /host/proc instead of container OSHI
- Concurrency: replaced synchronized with AtomicReference in 3 services
- Global error handling: added @RestControllerAdvice for JSON error responses
- Unit tests: added 32 tests for /proc parsers, CPU usage, process uptime
- Docker security: non-root user, read-only FS, no-new-privileges, healthcheck
- Debug logging: added log.debug() in silent catch blocks
- Documentation: updated README, INSTALLATION, DEVELOPMENT, CONFIGURATION,
  ARCHITECTURE, CHANGELOG

Co-authored-by: Junie <junie@jetbrains.com>

docs/ARCHITECTURE.md

@@ -35,7 +35,21 @@ Controllers expose system information to the frontend, while service classes col
 
 ## System information
 
-OSHI is used to obtain operating-system and hardware information. The data available depends on the runtime environment and permissions.
+The application collects system metrics through two complementary approaches:
+
+1. **Direct `/proc` parsing** — Services read host files directly from mounted paths (`/host/proc`, `/host/sys`, `/host/etc`) to obtain accurate host metrics rather than container metrics.
+2. **OSHI fallback** — If mounted files are unavailable, OSHI provides a fallback source of system information.
+
+### Host filesystem access
+
+To minimize the attack surface, the container mounts specific host directories rather than the entire root filesystem:
+
+- `/proc` → `/host/proc` — CPU, memory, processes, network, disk mounts
+- `/sys` → `/host/sys` — Network interface details
+- `/etc/hostname` and `/etc/os-release` → `/host/etc/` — Host identification
+- Selected mount points (`/var`, `/home`, `/opt`, etc.) → `/host/` — Disk space information
+
+See `docs/CONFIGURATION.md` for the complete list of volume mounts and instructions for adding custom mount points.
 
 ## Packaging