Major improvements: multi-stage Docker, security hardening, host metrics, tests

- Multi-stage Docker build: Dockerfile compiles frontend (Node.js) and
  backend (Gradle) inside Docker; no local Java/Node.js required
- Security hardening: replaced full host root mount with specific
  directory mounts (/proc, /sys, /etc, /var, /home, /opt, /tmp, /srv, /usr)
- Host metrics consistency: LinuxMemoryService and CpuDetailsService now
  read from /host/proc instead of container OSHI
- Concurrency: replaced synchronized with AtomicReference in 3 services
- Global error handling: added @RestControllerAdvice for JSON error responses
- Unit tests: added 32 tests for /proc parsers, CPU usage, process uptime
- Docker security: non-root user, read-only FS, no-new-privileges, healthcheck
- Debug logging: added log.debug() in silent catch blocks
- Documentation: updated README, INSTALLATION, DEVELOPMENT, CONFIGURATION,
  ARCHITECTURE, CHANGELOG

Co-authored-by: Junie <junie@jetbrains.com>

docs/CONFIGURATION.md

@@ -23,6 +23,42 @@ Review the actual configuration file before changing application properties. Thi
 
 System metrics available to the application depend on the operating system, container runtime, mounted filesystems, and granted permissions.
 
+### Volume mounts
+
+The application mounts specific host directories rather than the entire root filesystem, to minimize the attack surface:
+
+| Host path | Container path | Purpose |
+|---|---|---|
+| `/proc` | `/host/proc` | CPU, memory, processes, network, disk mounts |
+| `/sys` | `/host/sys` | Network interface details |
+| `/etc/hostname` | `/host/etc/hostname` | Host name |
+| `/etc/os-release` | `/host/etc/os-release` | OS information |
+| `/var` | `/host/var` | Disk space for `/var` mounts |
+| `/home` | `/host/home` | Disk space for `/home` mounts |
+| `/opt` | `/host/opt` | Disk space for `/opt` mounts |
+| `/tmp` | `/host/tmp` | Disk space for `/tmp` mounts |
+| `/srv` | `/host/srv` | Disk space for `/srv` mounts |
+| `/usr` | `/host/usr` | Disk space for `/usr` mounts |
+
+If your system has additional mount points (e.g., `/data`, `/mnt`), add them to the `volumes` section in `docker-compose.yml`:
+
+```yaml
+volumes:
+  - /data:/host/data:ro
+```
+
+### Security hardening
+
+The container runs with these security settings:
+
+- `read_only: true` — container filesystem is read-only
+- `no-new-privileges:true` — prevents privilege escalation
+- `tmpfs` on `/tmp` — temporary storage in memory
+- Non-root user (`appuser`) — application does not run as root
+- `pid: host` — required to see host processes
+
+### Docker Desktop limitation
+
 A container does not automatically have complete visibility into its host. Docker Desktop on Windows runs Linux containers in a virtualized Linux environment, so reported metrics may describe that environment rather than Windows itself.
 
 Do not expose the monitoring interface to untrusted networks without appropriate access controls and network security.