A `Dockerfile` opens as its stages: base image, ports, and each instruction as one row #11188

For: every file renders in the browser (#7329): a reader sees what an image is built from without reading the text.

Same pattern as src/web/render/openapi.ts (named in kinds.ts and renderers.ts). Matches Dockerfile, Containerfile and *.Dockerfile.

Done when:

• [x] Each FROM starts a stage block with its image (and AS name); EXPOSE ports and ENV names show at the stage head; every other instruction is one row with its keyword and arguments, continuation lines joined.
• [x] The raw text stays one tap away; an unparsable file falls back to plain text.
• [x] Every value is escaped; no dependency; a size cap like the other renderers.
• [x] test/render-dockerfile.test.ts covers a two-stage build, a continued RUN, a comment, a value with <script>, and the fallback.
• [x] docs/features/file-dockerfile.md; bun scripts/design-lint.ts passes.

Files: src/web/render/dockerfile.ts (new), src/web/render/kinds.ts, src/web/render/renderers.ts, the test, the doc. Risk: lands after or beside the .sql renderer; both touch kinds.ts and renderers.ts by one line each, so rebase rather than redo.

Reviewed pull #11199 at its head: ticked Each FROM starts a stage block with its image (and AS name); EXPOSE ports and ENV names show at the stage head; every other instruction is one row with its keyword and arguments, continuation lines joined.; The raw text stays one tap away; an unparsable file falls back to plain text.; Every value is escaped; no dependency; a size cap like the other renderers.; test/render-dockerfile.test.ts covers a two-stage build, a continued RUN, a comment, a value with <script>, and the fallback.; docs/features/file-dockerfile.md; bun scripts/design-lint.ts passes..