deploy: switch frontend to standalone production build

Frontend Dockerfile becomes multi-stage (deps/builder/production/dev)
with a Next.js standalone runtime and a 1GB heap cap to fit this host.
Compose targets the production stage, binds the frontend to
127.0.0.1:3001 for the 1Panel openresty proxy, drops dev volume
mounts and the publicly exposed postgres/backend ports, and passes
AUTH_URL/NEXTAUTH_URL/AUTH_TRUST_HOST so NextAuth works behind the
reverse proxy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -6,8 +6,6 @@ services:
       POSTGRES_USER: ${POSTGRES_USER:-evan}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-evanpass}
       POSTGRES_DB: ${POSTGRES_DB:-evanpage}
-    ports:
-      - "5432:5432"
     volumes:
       - pgdata:/var/lib/postgresql/data
     healthcheck:
@@ -31,8 +29,6 @@ services:
       AUTH_KEYCLOAK_ISSUER: ${AUTH_KEYCLOAK_ISSUER:-}
       AUTH_KEYCLOAK_ID: ${AUTH_KEYCLOAK_ID:-}
       AUTH_KEYCLOAK_SECRET: ${AUTH_KEYCLOAK_SECRET:-}
-    ports:
-      - "8080:8080"
     volumes:
       - ./backend:/app
       - /app/tmp
@@ -45,6 +41,7 @@ services:
   frontend:
     build:
       context: ./frontend
+      target: production
     container_name: evanpage-frontend
     environment:
       SERVER_API_URL: ${SERVER_API_URL:-http://backend:8080}
@@ -53,11 +50,11 @@ services:
       AUTH_KEYCLOAK_ISSUER: ${AUTH_KEYCLOAK_ISSUER:-}
       AUTH_KEYCLOAK_ID: ${AUTH_KEYCLOAK_ID:-}
       AUTH_KEYCLOAK_SECRET: ${AUTH_KEYCLOAK_SECRET:-}
+      AUTH_URL: ${AUTH_URL:-https://www.liukersun.com}
+      NEXTAUTH_URL: ${NEXTAUTH_URL:-https://www.liukersun.com}
+      AUTH_TRUST_HOST: ${AUTH_TRUST_HOST:-true}
     ports:
-      - "3000:3000"
-    volumes:
-      - ./frontend:/app
-      - /app/node_modules
+      - "127.0.0.1:3001:3000"
     depends_on:
       - backend
     networks: