reze: Fix unicode splitting, strict booleans, symbol validation and entropy

Six fixes, each with a test:

1. Character pools are built as arrays of code points, so astral characters
   (emoji) are never split into lone surrogates. Entropy counts code points.
2. Boolean options are parsed strictly: true/false, 1/0, "true"/"false",
   "1"/"0", "yes"/"no", "on"/"off" (case-insensitive). Anything else
   is a 400 naming the option instead of a silent truthy fallback.
3. customSymbols is validated: at most 64 code points, duplicates dropped,
   control characters and whitespace rejected with a 400.
4. Random mode entropy with requireEach now counts only the passwords that
   contain a character of every enabled class (inclusion-exclusion). The
   value is an upper bound and is labelled as such in the API
   (entropyApproximate/entropyNote) and in the UI.
5. docker-compose.yml uses expose instead of ports, so it no longer
   collides with Dokploy's own port 3000.
6. SIGTERM/SIGINT shut the server down gracefully: close the listener, let
   in-flight requests finish, force-exit after 5s. Measured at ~60ms.

The server now exports createServer() so the API can be tested over HTTP
without binding a fixed port.

public/app.js

@@ -239,12 +239,16 @@
 
       const entropy = document.createElement('span');
       entropy.className = 'pw-entropy';
-      entropy.textContent = item.entropy + ' bits';
+      var approximate = Boolean(item.entropyApproximate);
+      entropy.textContent = (approximate ? '~' : '') + item.entropy + ' bits';
+      if (approximate) {
+        entropy.setAttribute('title', 'Upper bound: the generator samples the valid passwords non-uniformly.');
+      }
 
       const level = strengthLevel(item.entropy);
       const label = document.createElement('span');
       label.className = 'pw-strength-label';
-      label.textContent = STRENGTH_LABELS[level];
+      label.textContent = STRENGTH_LABELS[level] + (approximate ? ' (approx.)' : '');
 
       const copy = document.createElement('button');
       copy.type = 'button';
@@ -269,18 +273,21 @@
 
   function payloadFor(state) {
     if (state.mode === 'random') {
-      return {
+      var payload = {
         mode: 'random',
         length: state.length,
         useLower: state.useLower,
         useUpper: state.useUpper,
         useDigits: state.useDigits,
         useSymbols: state.useSymbols,
-        customSymbols: state.customSymbols,
         excludeAmbiguous: state.excludeAmbiguous,
         requireEach: state.requireEach,
         count: state.count
       };
+      // The server rejects invalid symbol sets, so only send the custom set
+      // when the symbols class is actually in use.
+      if (state.useSymbols) payload.customSymbols = state.customSymbols;
+      return payload;
     }
     return {
       mode: 'memorable',