Bake full-stack toolchain into the web template's Docker image

templates/web (Coder's "Web Applications" profile) previously just pulled
codercom/enterprise-base:ubuntu and installed Bun at workspace start. Add a
Dockerfile that builds a complete dev image: build-essential/clang/llvm,
Tauri 2 / WebKit GUI prerequisites, Postgres/Redis/SQLite CLI clients,
protobuf-compiler, Python 3 + OpenCV/ONNX/CPU-torch, Node LTS + Bun/pnpm/
yarn, and a full Rust toolchain via rustup (rustfmt/clippy/rust-analyzer/
rust-src, musl+gnu x86_64/aarch64 targets, cargo-watch/cargo-edit/cross/
bacon) under a passwordless-sudo `coder` user.

main.tf now builds this Dockerfile via the docker provider's `docker_image`
resource (context = the template's own directory, tag keyed on the
Dockerfile's hash) instead of pulling the generic base image, and drops the
now-redundant standalone Bun-install coder_script since Bun ships baked into
the image and lands in the persistent home volume via Docker's normal
empty-volume-populated-from-image behavior. Also add rust-analyzer and Tauri
extensions to profile.code-profile, which was otherwise all web/Vue tooling
with nothing for the new Rust/Tauri side of the stack.

README.md

@@ -18,10 +18,34 @@ templates/
   cobol/        (same 4 files)  # COBOL Modern Mainframe
   python/       (same 4 files)  # Python Engineering
   ttrpg/        (same 4 files)  # TTRPG & Lore Building
-  web/          (same 4 files)  # Web Applications
+  web/          (same 4 files, plus Dockerfile)  # Web Applications
 extensions/                 # Agent Skills bundles, installed per env (see below)
 ```
 
+### Web Applications: baked-in toolchain image
+
+Every other template pulls `codercom/enterprise-base:ubuntu` straight from
+Docker Hub and installs what little it needs (just Bun) via a `coder_script`
+at workspace start. `templates/web/` doesn't do that: it needs a large,
+slow-to-install native toolchain (Rust/rustup with cross targets, the Tauri 2
+/ WebKit GUI dev libraries, Node + Bun + pnpm/yarn, Python with OpenCV/ONNX/
+CPU-torch, Postgres/Redis/SQLite CLI clients, protoc, clang/llvm) that would
+make every workspace start take many minutes if installed on the fly.
+
+Instead `templates/web/main.tf` builds `templates/web/Dockerfile` at
+apply/push time via the `docker` provider's `docker_image` resource (`build
+{ context = path.module }`, same directory as `main.tf` so no `file()`
+reaches outside the template per the constraint above) and runs the
+container from that image instead of the enterprise-base one. The image tag
+embeds `filesha1(Dockerfile)`, so editing the Dockerfile forces a rebuild on
+the next apply/push while an unchanged Dockerfile reuses Docker's build
+cache. Because the toolchain lives under `/home/coder` (rustup, cargo, bun),
+and that path is a fresh *named* Docker volume on a workspace's first boot,
+Docker's own "populate an empty volume from the image's directory contents"
+behavior copies all of it into the persistent volume automatically - no
+extra `coder_script` needed, matching how the `/etc/skel` copy in every
+template's `startup_script` already relies on that same mechanism.
+
 Each `templates/<env>/` is a complete, independent Coder template (agent,
 docker container, code-server, JetBrains) with its own copy of everything
 `main.tf` needs. They're deliberately not built from a shared Terraform
@@ -71,12 +95,14 @@ never really worked.
 
 ### Bun
 
-Every template installs [Bun](https://bun.sh) via a `coder_script`
-(`curl -fsSL https://bun.sh/install | bash`) and hooks `~/.bun/bin` onto
-`PATH` in `~/.bashrc` (the installer doesn't reliably do this itself in a
-non-interactive/scripted shell). The CLI setup wizard below uses
-`bun install -g <pkg>` instead of `npm install -g <pkg>` for everything it
-installs.
+Every template except `web` installs [Bun](https://bun.sh) via a
+`coder_script` (`curl -fsSL https://bun.sh/install | bash`) and hooks
+`~/.bun/bin` onto `PATH` in `~/.bashrc` (the installer doesn't reliably do
+this itself in a non-interactive/scripted shell). `web` instead bakes Bun
+into its Dockerfile with `BUN_INSTALL`/`PATH` set as image `ENV` - see "Web
+Applications: baked-in toolchain image" above. Either way, the CLI setup
+wizard below uses `bun install -g <pkg>` instead of `npm install -g <pkg>`
+for everything it installs.
 
 ### CLI setup wizard