Major improvements: multi-stage Docker, security hardening, host metrics, tests

- Multi-stage Docker build: Dockerfile compiles frontend (Node.js) and
  backend (Gradle) inside Docker; no local Java/Node.js required
- Security hardening: replaced full host root mount with specific
  directory mounts (/proc, /sys, /etc, /var, /home, /opt, /tmp, /srv, /usr)
- Host metrics consistency: LinuxMemoryService and CpuDetailsService now
  read from /host/proc instead of container OSHI
- Concurrency: replaced synchronized with AtomicReference in 3 services
- Global error handling: added @RestControllerAdvice for JSON error responses
- Unit tests: added 32 tests for /proc parsers, CPU usage, process uptime
- Docker security: non-root user, read-only FS, no-new-privileges, healthcheck
- Debug logging: added log.debug() in silent catch blocks
- Documentation: updated README, INSTALLATION, DEVELOPMENT, CONFIGURATION,
  ARCHITECTURE, CHANGELOG

Co-authored-by: Junie <junie@jetbrains.com>

docs/INSTALLATION.md

@@ -4,11 +4,35 @@
 
 - Docker Engine
 - Docker Compose
-- Java 21 and Node.js/npm if building the application locally
 
-## Build the application
+No local Java or Node.js installation is required — the Dockerfile uses multi-stage build to compile everything inside Docker.
 
-From the repository root:
+## Build and start with Docker Compose
+
+From the repository root, run a single command:
+
+```bash
+docker compose up -d --build
+```
+
+The `--build` flag triggers the multi-stage Docker build that compiles both the Angular frontend and the Spring Boot backend inside Docker. No local JDK or Node.js is needed.
+
+The default Compose configuration maps host port `8088` to container port `8080`.
+
+Open http://localhost:8088 in your browser.
+
+## Alternative: Build the image manually
+
+If you prefer to build the Docker image separately:
+
+```bash
+docker build -t htop-web .
+docker compose up -d
+```
+
+## Alternative: Local Gradle build (requires Java 21 and Node.js)
+
+If you need to build locally (for example, to run tests):
 
 ```bash
 cd backend
@@ -18,16 +42,6 @@ cd ..
 
 The Gradle build also builds the Angular frontend and packages its production assets into the Spring Boot application.
 
-## Start with Docker Compose
-
-```bash
-docker compose up -d --build
-```
-
-The default Compose configuration maps host port `8088` to container port `8080`.
-
-Open http://localhost:8088 in your browser.
-
 ## Check status and logs
 
 ```bash
@@ -43,16 +57,29 @@ docker compose down
 
 ## Simple Scenario of using
 
-```bash
+```yaml
 services:
   htop-web:
     image: gitea.jambotron.com/liosha84/htop-web:latest
     container_name: htop-web
     restart: unless-stopped
     pid: host
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp:noexec,nosuid,size=64m
     volumes:
+      - /proc:/host/proc:ro
       - /sys:/host/sys:ro
-      - /:/host/root:ro
+      - /etc/hostname:/host/etc/hostname:ro
+      - /etc/os-release:/host/etc/os-release:ro
+      - /var:/host/var:ro
+      - /home:/host/home:ro
+      - /opt:/host/opt:ro
+      - /tmp:/host/tmp:ro
+      - /srv:/host/srv:ro
+      - /usr:/host/usr:ro
     labels:
       caddy: htop-web.jambotron.com
       caddy.reverse_proxy: "{{upstreams 8080}}"
@@ -64,6 +91,6 @@ networks:
     external: true
 ```
 
-```bash 
+```bash
 docker compose up -d
 ```