v2.0.1 — security patch (Docker Hub CVE false positives)

Patch release: clears two false-positive vulnerability findings reported by Docker Hub against bun4uk/chadmin:2.0.0, and adopts the consolidated Dockerfile refactor merged via #2.

What changed

• #2 by @everythings-gonna-be-alright — Single multi-stage docker/Dockerfile with base (php-fpm only) and aio (php-fpm + nginx + supervisord) targets. AIO image now runs as the unprivileged chadmin user (UID 1984). docker/dev + docker/prod configs consolidated under docker/configs/.
• CVE-2023-27482 (Home Assistant Supervisor name collision with Alpine apk:supervisor) — declared not_affected via OpenVEX (vex/chadmin.openvex.json), attached to the published image as a sigstore attestation by the publish workflow.
• CVE-2026-24049 (wheel.cli.unpack path traversal) — cleared by removing the vendored wheel-*.dist-info inside py3-setuptools. The vendored copy is metadata only — no Python source — so removal is safe; setuptools ≥70.1 uses its own bdist_wheel and never imports _vendor/wheel at runtime. Same CVE is also declared not_affected in the OpenVEX statement as a backup.

Docker

docker pull bun4uk/chadmin:2.0.1    # or :latest

Drop-in upgrade from 2.0.0 — no behaviour changes.