fix(training): bundle reference content + use docker bridge gateway

The Style Studio's curator-prompt + chat features read reference docs
from disk at runtime. Two issues from the initial production run:

1. Dockerfile + .dockerignore excluded .claude/, docs/, and most of
   skills/. Now COPY the four specific files the new endpoints need:
     - .claude/agents/hermes-curator.md
     - skills/decision/SKILL.md
     - docs/legal-decision-lessons.md
     - docs/corpus-analysis.md
   .dockerignore opens whitelists for just those files.

2. Coolify's custom_docker_run_options=--add-host=host.docker.internal:host-gateway
   is not honored on dockerimage build_pack apps (ExtraHosts stayed []).
   Switch chat_proxy.py default to http://10.0.1.1:8770 — the docker0
   bridge gateway, same pattern Paperclip uses for 3100. Bind the host
   pm2 service to 0.0.0.0:8770 so the container can reach it via the
   bridge IP. Oracle Cloud's security list keeps the port unreachable
   from the public internet.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

web/chat_proxy.py

@@ -33,13 +33,20 @@ from web import chat_system_prompt
 logger = logging.getLogger(__name__)
 
 
-# legal-chat-service lives on the host. In the container we reach it via
-# host.docker.internal — which requires ``extra_hosts: host.docker.internal:host-gateway``
-# in the Coolify service definition. Set ``CHAT_SERVICE_URL`` to override
-# (handy for local dev outside Docker).
+# legal-chat-service lives on the host (pm2-managed, bound to 0.0.0.0:8770).
+# From inside the container we reach it via the docker bridge gateway —
+# 10.0.1.1 is the host on docker0 (the same address Paperclip uses for
+# its 3100 bridge). Override with CHAT_SERVICE_URL if running outside
+# Docker (local dev).
+#
+# Coolify's `custom_docker_run_options: --add-host=host.docker.internal:host-gateway`
+# turned out NOT to apply to dockerimage-built apps as of Coolify 4.0.0,
+# so the explicit IP is the reliable path. The cloud-level firewall
+# (Oracle security list) keeps port 8770 unreachable from the public
+# internet, matching the security posture of Paperclip's 3100.
 CHAT_SERVICE_URL = os.environ.get(
     "CHAT_SERVICE_URL",
-    "http://host.docker.internal:8770",
+    "http://10.0.1.1:8770",
 )
 CHAT_SERVICE_TIMEOUT_S = float(os.environ.get("CHAT_SERVICE_TIMEOUT_S", "3600"))