Self host rework

[Lethalchip]

Summary

Finishes the self-host-rework branch. Pogly Standalone is now self-host only and ships as a single Docker image that supports both anonymous-token (Mode 1) and third-party OIDC (Mode 2) auth, with the mode chosen at runtime via -e flags rather than at build time.

The original CI/docker build failure is also fixed: the Dockerfile was pulling clockworklabs/spacetime:latest (now v2.x), which is no longer ABI-compatible with the v1.7.0 SpacetimeDB.Runtime pinned in server/StdbModule.csproj.

See docs/SELF_HOSTING.md for the full user-facing rundown.

What changed

• Docker + CI pinned to SpacetimeDB v1.7.0; entrypoint and Caddyfile updated for the v1.x CLI/API.
• Runtime OIDC config injection via /config.js (entrypoint writes it from -e env vars; SPA reads window.POGLY_RUNTIME_CONFIG).
• Sentinel-based publish skip so restarting with a persistent /stdb volume doesn't trigger 401-ownership errors.
• Connection dropdown: docker preset replaces cloud.
• All standalone.pogly.gg / cloud.pogly.gg origin sentinels removed; same-origin defaults everywhere.
• New docs/SELF_HOSTING.md; README points at it.

Test plan

• Local docker build succeeds against pinned v1.7.0 base.
• Mode 1 round-trip: connect, onboard, place element, reload, element persists.
• Mode 2 round-trip with SpacetimeAuth: /config.js reflects env vars, OIDC overlay shows, sign-in works.
• Persistent volume across restarts: sentinel skips republish, canvas state preserved.
• Wipe-and-recreate: volume delete forces fresh publish + new onboarding.
• CI docker workflow goes green on this branch.