case 4727 - remove the unused Docker option

dist/docker (a runtime dockerfile and a compose file that published
PostgreSQL with a fixed password) was from early development and never
offered. Removed with its commented-out lines in build-release.bat and
the BUILD.md mention; the build-environment Dockerfiles for the docs and
the client stay. F38 (4727 step 7, the last step).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build-release.bat

@@ -79,17 +79,6 @@ set m=BUILD PERPETUAL LINUX x64 FAILED
 goto FAIL
 )
 
-@REM ### DISCONTINUED INDEFINITELY ###
-@REM rem LINUX DOCKER
-@REM rmdir C:\data\code\raven\dist\docker\linux-x64\ayanovadocker\files /s/q
-@REM mkdir C:\data\code\raven\dist\docker\linux-x64\ayanovadocker\files
-@REM xcopy C:\data\code\raven\dist\linux-x64\* C:\data\code\raven\dist\docker\linux-x64\ayanovadocker\files /s /e
-@REM "C:\Program Files\7-Zip\7z.exe" a -tzip "C:\data\code\raven\dist\installers\ayanova-linux-docker-x64-server.zip" "C:\data\code\raven\dist\docker\linux-x64\*" -r
-@REM IF %ERRORLEVEL% NEQ 0 (
-@REM set m=BUILD LINUX x64 DOCKER ZIP FAILED
-@REM goto FAIL
-@REM )
-
 rem LINUX DESKTOP
 "C:\Program Files\7-Zip\7z.exe" a -tzip "C:\data\code\raven\dist\installers\ayanova-linux-x64-desktop.zip" "C:\data\code\raven\dist\linux-x64\*" -r
 "C:\Program Files\7-Zip\7z.exe" a -tzip "C:\data\code\raven\dist\installers\ayanova-linux-x64-desktop.zip" "C:\data\code\raven\dist\assets\linux-desktop\config.json" 

devdocs/build/BUILD.md

@@ -131,8 +131,7 @@ Set in five places for every release:
 ## Docker builds
 
 `raven-client\ayanova\Dockerfile.frontend` and `raven\Dockerfile.docs` build the front end
-and the manual in containers. A runtime image and compose file for the Linux server are in
+and the manual in containers. The Linux server packages and the Windows
-`raven\dist\docker\linux-x64\`. The Linux server packages and the Windows
 framework-dependent build could also build in Docker. Windows self-contained builds, Inno
 Setup, QBI and the embedded PostgreSQL need Windows.
 

devdocs/modernization/NET10-PORT.md

@@ -193,7 +193,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
 | 4724 | SMTP: certificate checked, password never returned | F30, F31. **Done** (certificate checked, opt-out config setting `AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE` with manual page; password masked as `********` and kept on save; test `SmtpPasswordHidden`; self-signed listener proof; changelog lines for both) |
 | 4725 | Sessions: password change ends sessions, exact-path token exemption, default SuperUser refused when licensed | F7, F8, F9. **Done** (sessions end on reset, administrator password change and login disabled; exact route exemption, inactive users refused; default-password SuperUser limited to changing it on a purchased licence, option A; test `Sessions`; John's click-through with a temporary licence override; manual and changelog) |
 | 4726 | Login throttling/lockout (raven and sockeye) | F6. **Done** (10 failures per login or 50 per address in 15 minutes, then 429 for the rest of the window; same in Sockeye, whose login is public; test `LoginLockout`; per-address limit proved with a forwarded documentation address) |
-| 4727 | Low severity hardening | F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously). In steps: 1 logo (F23) **done**; 2 API root page (F11, F39) **done**; 3 `server-info` (F29) **done**; 4 template export (F22) **done**, job owner check accepted; 5 `OverrideUserId` and export download (F25) **done**; 6 safe headers (F35) **done**; 7 remove `dist/docker` (F38) |
+| 4727 | Low severity hardening | F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously). In steps: 1 logo (F23) **done**; 2 API root page (F11, F39) **done**; 3 `server-info` (F29) **done**; 4 template export (F22) **done**, job owner check accepted; 5 `OverrideUserId` and export download (F25) **done**; 6 safe headers (F35) **done**; 7 remove `dist/docker` (F38) **done**. All steps done; outside this repo, for `sockeye-client`: bind `127.0.0.1`, the `chmod`, the systemd options (F36, F38) |
 | 4681 | Sockeye: licence/trial request hardening (tagged sockeye, rockfish) | F40. **Done** (sockeye `cd3ebed`: rate limits, email check, cryptographic codes; rvf unchanged) |
 
 **From the port and earlier triage**

devdocs/modernization/SECURITY-REVIEW.md

@@ -780,7 +780,7 @@ prepared database, so it is not that short: accepted.
   superuser password. It is not built (`build-release.bat` lines are commented out) or
   documented; delete it or fix it before anyone uses it.
 
-**John, 2026-10-24:** the `chmod` and the systemd sandboxing options go into the `sockeye-client` setup script (to do there; the systemd options need testing on a droplet so nothing that writes, such as logs, backups or the report browser download, is blocked). `dist/docker`: early development option, never offered: removed in case 4727.
+**John, 2026-10-24:** the `chmod` and the systemd sandboxing options go into the `sockeye-client` setup script (to do there; the systemd options need testing on a droplet so nothing that writes, such as logs, backups or the report browser download, is blocked). `dist/docker`: early development option, never offered: removed in case 4727, step 7 (2026-10-24; with its commented-out lines in `build-release.bat`; git history keeps it).
 
 OK in pass 10: the setup script generates a unique database password and JWT secret per
 droplet, stores them in `/root/ayanova-secrets.txt` (600), makes `config.json` 640 `root:www-data`,

dist/docker/linux-x64/ayanovadocker/dockerfile

@@ -1,15 +0,0 @@
-FROM mcr.microsoft.com/dotnet/aspnet:6.0-alpine
-WORKDIR /app
-COPY ./files .
-RUN apk add libgdiplus --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing/
-RUN apk add postgresql-client
-RUN apk add --no-cache \
-      chromium \
-      nss \
-      freetype \
-      freetype-dev \
-      harfbuzz \
-      ca-certificates \
-      ttf-freefont
-      
-ENTRYPOINT ["dotnet", "AyaNova.dll"]

dist/docker/linux-x64/docker-compose.yml

@@ -1,44 +0,0 @@
-version: '2'
-
-services:
-
-    
-  postgresserver:
-     image: postgres:alpine
-     restart: always
-     ports:
-       - 5432:5432
-     environment:
-         POSTGRES_PASSWORD: letmein
-     volumes:
-       - /var/lib/ayanova/db:/var/lib/postgresql/data
-
-  ayanova:
-     image: gztw/ayanova:v8.0.0
-     init: true
-     restart: always
-     ports:
-       - 7575:7575
-     volumes:
-       - /var/lib:/var/lib
-     environment:
-        AYANOVA_USE_URLS: http://*:7575
-        AYANOVA_DB_CONNECTION: User ID=postgres;Password=letmein;Host=postgresserver;Port=5432;Database=AyaNova;Pooling=true;CommandTimeout=90;  
-        AYANOVA_ATTACHMENT_FILES_PATH: /var/lib/ayanova/files/user    
-        AYANOVA_BACKUP_FILES_PATH: /var/lib/ayanova/files/backup
-        AYANOVA_TEMP_FILES_PATH: /var/lib/ayanova/files/temp
-        AYANOVA_LOG_PATH: /var/lib/ayanova
-        AYANOVA_LOG_LEVEL: Info
-        AYANOVA_REPORT_RENDER_BROWSER_PATH: /usr/bin/chromium-browser
-     build:
-       context: ./ayanovadocker
-       dockerfile: Dockerfile
-     links:
-       - postgresserver
-     depends_on:
-       - "postgresserver"
-
-networks:
-  default:
-    external:
-      name: docker-network