Move SW render + flutter build into a stage script so secret values are
not expanded into Dockerfile RUN instructions. Document that APP_ID must
be a Web (:web:) app id and that secrets belong on the deploy host .env.
Co-authored-by: okuma <o0kuma@users.noreply.github.com>