Major improvements: multi-stage Docker, security hardening, host metrics, tests

- Multi-stage Docker build: Dockerfile compiles frontend (Node.js) and
  backend (Gradle) inside Docker; no local Java/Node.js required
- Security hardening: replaced full host root mount with specific
  directory mounts (/proc, /sys, /etc, /var, /home, /opt, /tmp, /srv, /usr)
- Host metrics consistency: LinuxMemoryService and CpuDetailsService now
  read from /host/proc instead of container OSHI
- Concurrency: replaced synchronized with AtomicReference in 3 services
- Global error handling: added @RestControllerAdvice for JSON error responses
- Unit tests: added 32 tests for /proc parsers, CPU usage, process uptime
- Docker security: non-root user, read-only FS, no-new-privileges, healthcheck
- Debug logging: added log.debug() in silent catch blocks
- Documentation: updated README, INSTALLATION, DEVELOPMENT, CONFIGURATION,
  ARCHITECTURE, CHANGELOG

Co-authored-by: Junie <junie@jetbrains.com>

docs/DEVELOPMENT.md

@@ -8,6 +8,8 @@
 
 ## Build and test
 
+### Option 1: Gradle build (requires Java 21 and Node.js)
+
 From the repository root:
 
 ```bash
@@ -17,6 +19,21 @@ cd backend
 
 This invokes the configured Gradle build, including frontend build tasks.
 
+### Option 2: Docker multi-stage build (requires only Docker)
+
+Build the entire application inside Docker — no local Java or Node.js required:
+
+```bash
+docker build -t htop-web .
+```
+
+This uses a multi-stage Dockerfile with three stages:
+1. **Frontend** — builds Angular with Node.js 22 Alpine
+2. **Builder** — compiles the backend with Gradle and Java 21 JDK
+3. **Runtime** — packages only the JAR and Java 21 JRE (~200 MB final image)
+
+The Docker build is fully reproducible and does not depend on tools installed on the host machine.
+
 ## Frontend development
 
 Frontend source code is located in `frontend/`.
@@ -38,13 +55,42 @@ If the project does not define a `start` script, inspect `frontend/package.json`
 
 ## Run the container
 
-From the repository root, after a successful build:
+### With Docker Compose (recommended)
+
+From the repository root:
 
 ```bash
 docker compose up -d --build
 docker compose logs -f htop-web
 ```
 
+The `--build` flag triggers the multi-stage Docker build automatically.
+
+### With Docker only
+
+If you built the image manually:
+
+```bash
+docker run -d \
+  --name htop-web \
+  --pid host \
+  --read-only \
+  --security-opt no-new-privileges:true \
+  --tmpfs /tmp:noexec,nosuid,size=64m \
+  -v /proc:/host/proc:ro \
+  -v /sys:/host/sys:ro \
+  -v /etc/hostname:/host/etc/hostname:ro \
+  -v /etc/os-release:/host/etc/os-release:ro \
+  -v /var:/host/var:ro \
+  -v /home:/host/home:ro \
+  -v /opt:/host/opt:ro \
+  -v /tmp:/host/tmp:ro \
+  -v /srv:/host/srv:ro \
+  -v /usr:/host/usr:ro \
+  -p 8080:8080 \
+  htop-web
+```
+
 ## Contribution guidelines
 
 - Keep changes focused and reviewable.