Bake full-stack toolchain into the web template's Docker image

templates/web (Coder's "Web Applications" profile) previously just pulled
codercom/enterprise-base:ubuntu and installed Bun at workspace start. Add a
Dockerfile that builds a complete dev image: build-essential/clang/llvm,
Tauri 2 / WebKit GUI prerequisites, Postgres/Redis/SQLite CLI clients,
protobuf-compiler, Python 3 + OpenCV/ONNX/CPU-torch, Node LTS + Bun/pnpm/
yarn, and a full Rust toolchain via rustup (rustfmt/clippy/rust-analyzer/
rust-src, musl+gnu x86_64/aarch64 targets, cargo-watch/cargo-edit/cross/
bacon) under a passwordless-sudo `coder` user.

main.tf now builds this Dockerfile via the docker provider's `docker_image`
resource (context = the template's own directory, tag keyed on the
Dockerfile's hash) instead of pulling the generic base image, and drops the
now-redundant standalone Bun-install coder_script since Bun ships baked into
the image and lands in the persistent home volume via Docker's normal
empty-volume-populated-from-image behavior. Also add rust-analyzer and Tauri
extensions to profile.code-profile, which was otherwise all web/Vue tooling
with nothing for the new Rust/Tauri side of the stack.

templates/web/Dockerfile

@@ -0,0 +1,87 @@
+# Web Applications workspace image: Rust (Tauri 2 / gRPC), Bun + Node/pnpm,
+# Python + CV/ONNX prototyping, and DB CLI clients baked in at build time so
+# workspace start doesn't pay for a from-scratch toolchain install.
+#
+# Built by templates/web/main.tf via the docker provider's `build` block
+# (context = this directory), not pulled from a registry.
+FROM ubuntu:24.04
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        locales sudo ca-certificates gnupg curl wget \
+    && locale-gen en_US.UTF-8 \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV LANG=en_US.UTF-8 \
+    LANGUAGE=en_US:en \
+    LC_ALL=en_US.UTF-8
+
+# Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
+# X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential pkg-config cmake clang llvm \
+        git git-lfs jq unzip tar file htop tree tmux zsh openssh-client \
+        libssl-dev libpq-dev libsqlite3-dev \
+        libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev \
+        libgtk-3-dev libsoup-3.0-dev \
+        libx11-dev libxext-dev libxrender-dev libxtst-dev libxi-dev \
+        postgresql-client redis-tools sqlite3 \
+        python3 python3-pip python3-venv python3-dev \
+        libopencv-dev \
+        protobuf-compiler \
+    && git lfs install --system \
+    && rm -rf /var/lib/apt/lists/*
+
+# Node.js LTS (22.x) plus npm/pnpm/yarn as root so global bins land on the
+# system PATH for every user.
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && npm install -g pnpm yarn \
+    && rm -rf /var/lib/apt/lists/*
+
+# Global Python prototyping packages: CV, ONNX runtime, CPU-only torch wheel.
+# Ubuntu 24.04's system Python is PEP 668 externally-managed; this is a
+# throwaway container image, so --break-system-packages is the right call
+# instead of forcing every user into a venv for basic prototyping.
+RUN python3 -m pip install --break-system-packages --no-cache-dir --upgrade pip \
+    && python3 -m pip install --break-system-packages --no-cache-dir \
+        numpy opencv-python-headless onnxruntime \
+    && python3 -m pip install --break-system-packages --no-cache-dir \
+        torch --index-url https://download.pytorch.org/whl/cpu
+
+# Standard non-root dev user with passwordless sudo.
+RUN useradd --uid 1000 --create-home --shell /bin/bash coder \
+    && echo "coder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder \
+    && chmod 0440 /etc/sudoers.d/coder
+
+ENV RUST_BACKTRACE=1 \
+    RUSTUP_HOME=/home/coder/.rustup \
+    CARGO_HOME=/home/coder/.cargo \
+    BUN_INSTALL=/home/coder/.bun \
+    PNPM_HOME=/home/coder/.local/share/pnpm \
+    PATH=/home/coder/.cargo/bin:/home/coder/.bun/bin:/home/coder/.local/share/pnpm:/home/coder/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+USER coder
+WORKDIR /home/coder
+
+# Rust via rustup: stable toolchain, rust-analyzer/clippy/rustfmt/rust-src,
+# native + musl targets for x86_64/aarch64, and cargo helper utilities.
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
+        --default-toolchain stable --profile default \
+    && rustup component add rustfmt clippy rust-analyzer rust-src \
+    && rustup target add \
+        x86_64-unknown-linux-gnu \
+        x86_64-unknown-linux-musl \
+        aarch64-unknown-linux-gnu \
+        aarch64-unknown-linux-musl \
+    && cargo install --locked cargo-watch cargo-edit cross bacon
+
+# Bun: global runtime for the ElysiaJS backend and fast scripting.
+RUN curl -fsSL https://bun.sh/install | bash
+
+# Prime the pnpm content-addressable store dir referenced by PNPM_HOME.
+RUN pnpm setup || true
+
+RUN mkdir -p /home/coder/workspace
+WORKDIR /home/coder/workspace