milestone 19: hygiene sweep - dead ecs surface, single-source constants, tls classification, frontend state hazards, docker smoke network fix

docs/how-to/install-with-docker.md

@@ -161,7 +161,9 @@ resolver.
 
 The Dockerfile maps buildx's `TARGETARCH` onto the cross-target directory, so
 the aarch64 image comes from the same `zig-out/cross` tree with no second
-compile:
+compile. Under the legacy builder, where `TARGETARCH` is empty, the Dockerfile
+falls back to the build host's `uname -m`, so a plain `docker build` on the Pi
+itself also selects the aarch64 binary:
 
 ```sh
 docker buildx build --platform linux/arm64 -t nxdns:arm64 -f deploy/docker/Dockerfile .