Move gatekeeper and keymaster clients to standalone containers

[macterra]

Summary

The gatekeeper and keymaster web clients are currently embedded within their respective service containers and served by Express. This creates unnecessary coupling and larger Docker images.

Proposed Changes

• Move services/gatekeeper/client/ → apps/gatekeeper-client/ (standalone Vite app, port 4225)
• Move services/keymaster/client/ → apps/keymaster-client/ (standalone Vite app, port 4227)
• Convert both from CRA (react-scripts) to Vite
• Add separate Dockerfiles and docker-compose service definitions
• Default SERVE_CLIENT=false in service containers (clients no longer embedded)
• Add CORS to keymaster API (gatekeeper already has it)
• Passphrase always required for keymaster client

Benefits

• Smaller service container images (no client build step)
• Independent scaling and deployment of clients vs APIs
• Consistent architecture with react-wallet