fix(security): add jq dependency and use it for safe JSON env injection

[onurege3467]

Closes #31

Replace the raw heredoc in docker-entrypoint.sh (which can produce
malformed JSON if env vars contain quotes, newlines, or other special
characters) with jq --arg, which properly JSON-encodes all values.

Changes:

• Dockerfile: Add jq as an explicit Alpine package dependency so
  it is always available at runtime
• docker-entrypoint.sh: Use jq -n --arg to generate the env-config.js
  JSON safely, instead of a raw heredoc that interpolates variables directly
  into JSON without escaping

Why this fix: The jq --arg command takes each value as a raw string
argument and handles JSON encoding internally — double quotes, backslashes,
newlines, null bytes, and all other special characters are properly escaped
in the output. The heredoc fallback (which lacked escaping for anything
beyond backslash, double-quote, and tab) is eliminated by ensuring jq is
always installed.

Verification:

• bash -n docker-entrypoint.sh — shell syntax clean
• jq --arg tested with quotes, newlines, empty values — all produce valid JSON
• Only Dockerfile and entrypoint changed; no JS/TS modifications