feat: add Zero query endpoint and configure ZERO_QUERY_URL

- Create app/api/zero/query/route.ts — resolves named queries to ZQL
  using handleQueryRequest and mustGetQuery from @rocicorp/zero
- Add ZERO_QUERY_URL to both docker-compose files:
  - dev: http://host.docker.internal:3000 (reaches local Next.js from Docker)
  - prod: http://frontend:3000 (Docker service networking)

Without this endpoint, zero-cache cannot resolve named queries and
no data syncs to the client.

docker/docker-compose.dev.yml

@@ -182,6 +182,7 @@ services:
       - ZERO_CHANGE_DB=${ZERO_CHANGE_DB:-postgresql://${DB_USER:-postgres}:${DB_PASSWORD:-postgres}@${DB_HOST:-db}:${DB_PORT:-5432}/${DB_NAME:-surfsense}?sslmode=${DB_SSLMODE:-disable}}
       - ZERO_REPLICA_FILE=/data/zero.db
       - ZERO_ADMIN_PASSWORD=${ZERO_ADMIN_PASSWORD:-surfsense-zero-admin}
+      - ZERO_QUERY_URL=${ZERO_QUERY_URL:-http://host.docker.internal:3000/api/zero/query}
     volumes:
       - zero_cache_data:/data
     restart: unless-stopped

docker/docker-compose.yml

@@ -168,6 +168,7 @@ services:
       ZERO_CHANGE_DB: ${ZERO_CHANGE_DB:-postgresql://${DB_USER:-surfsense}:${DB_PASSWORD:-surfsense}@${DB_HOST:-db}:${DB_PORT:-5432}/${DB_NAME:-surfsense}?sslmode=${DB_SSLMODE:-disable}}
       ZERO_REPLICA_FILE: /data/zero.db
       ZERO_ADMIN_PASSWORD: ${ZERO_ADMIN_PASSWORD:-surfsense-zero-admin}
+      ZERO_QUERY_URL: ${ZERO_QUERY_URL:-http://frontend:3000/api/zero/query}
     volumes:
       - zero_cache_data:/data
     restart: unless-stopped

surfsense_web/app/api/zero/query/route.ts

@@ -0,0 +1,18 @@
+import { mustGetQuery } from "@rocicorp/zero";
+import { handleQueryRequest } from "@rocicorp/zero/server";
+import { NextResponse } from "next/server";
+import { queries } from "@/zero/queries";
+import { schema } from "@/zero/schema";
+
+export async function POST(request: Request) {
+	const result = await handleQueryRequest(
+		(name, args) => {
+			const query = mustGetQuery(queries, name);
+			return query.fn({ args, ctx: undefined });
+		},
+		schema,
+		request,
+	);
+
+	return NextResponse.json(result);
+}