Terminal: job image tools (neovim/tmux), build-arg wiring, docs

- agent-job image: add neovim, tmux, less, unzip, wget, locales for the
  interactive shell (tmux powers cross-reconnect session persistence)
- Wire NEXT_PUBLIC_SPOON_AGENT_WORKER_WS_URL as a build arg (Dockerfile +
  compose.yml) since NEXT_PUBLIC vars are inlined at build time
- docs/agent-terminal.md: architecture, env, nginx WS exposure, dev testing,
  security; note the build-time var in docs/compose.prod.yml

docs/compose.prod.yml

@@ -46,6 +46,11 @@ services:
       - SPOON_AGENT_WORKER_URL=${SPOON_AGENT_WORKER_URL:-http://spoon-agent-worker:3921}
       - SPOON_AGENT_WORKER_INTERNAL_TOKEN=${SPOON_AGENT_WORKER_INTERNAL_TOKEN}
       - SPOON_WORKER_TOKEN=${SPOON_WORKER_TOKEN}
+    # NOTE: the Terminal tab needs NEXT_PUBLIC_SPOON_AGENT_WORKER_WS_URL, which is
+    # a NEXT_PUBLIC (build-time) var — it must be baked into the spoon-next image
+    # at build (via the build env file / CI), NOT set as a runtime env here. Also
+    # requires nginx to proxy worker.<domain> → spoon-agent-worker:3921 with WS
+    # upgrade. See docs/agent-terminal.md.
     depends_on: ['spoon-backend', 'spoon-postgres']
     labels: ['com.centurylinklabs.watchtower.enable=true']
     tty: true