feat(web): hq-sourced members are read-only here

The lock is a courtesy — the API answers 409 either way. NEXT_PUBLIC_HQ_URL
defaults empty so a self-hosted install shows a plain label rather than a
link to a portal that does not serve them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web/Dockerfile

@@ -17,6 +17,12 @@ COPY . .
 ARG NEXT_PUBLIC_API_URL=http://localhost:8080
 ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
 
+# Empty default on purpose: a self-hosted install has no HQ portal, and the
+# "Managed in Vantage HQ" label falls back to plain text rather than linking
+# somewhere that does not serve them.
+ARG NEXT_PUBLIC_HQ_URL=
+ENV NEXT_PUBLIC_HQ_URL=$NEXT_PUBLIC_HQ_URL
+
 RUN npm run build
 
 # Runtime stage