fix: Hardens web container

- document root is owned by root and not writable by www-data
  (the base image ships /var/www/html as www-data with mode 1777)
- uses php.ini-production, so errors are not shown to clients
- disables directory listings, expose_php and the detailed server signature

web/Containerfile

@@ -1,4 +1,17 @@
 FROM docker.io/library/php:apache
 
 RUN docker-php-ext-install mysqli bcmath
-COPY ./www/* /var/www/html
+
+# Use PHP's production defaults (no error output to clients) and hide the PHP version.
+RUN cp "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" \
+ && printf 'expose_php = Off\n' > "$PHP_INI_DIR/conf.d/zz-hardening.ini"
+
+# Disable directory listings and reduce the server signature.
+RUN sed -i 's/^\(\s*Options\) Indexes FollowSymLinks/\1 FollowSymLinks/' /etc/apache2/apache2.conf \
+ && sed -i -e 's/^ServerTokens .*/ServerTokens Prod/' -e 's/^ServerSignature .*/ServerSignature Off/' /etc/apache2/conf-available/security.conf
+
+COPY ./www/* /var/www/html
+
+# The web server must not be able to create or modify files in the document root.
+RUN chown -R root:root /var/www/html \
+ && chmod -R u=rwX,go=rX /var/www/html