deploy: switch frontend to standalone production build

Frontend Dockerfile becomes multi-stage (deps/builder/production/dev)
with a Next.js standalone runtime and a 1GB heap cap to fit this host.
Compose targets the production stage, binds the frontend to
127.0.0.1:3001 for the 1Panel openresty proxy, drops dev volume
mounts and the publicly exposed postgres/backend ports, and passes
AUTH_URL/NEXTAUTH_URL/AUTH_TRUST_HOST so NextAuth works behind the
reverse proxy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/Dockerfile

@@ -1,15 +1,37 @@
-FROM node:20-alpine
-
+FROM node:20-alpine AS deps
 WORKDIR /app
+COPY package*.json ./
+RUN npm ci
 
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV NODE_OPTIONS=--max-old-space-size=1024
+RUN npm run build
+
+FROM node:20-alpine AS production
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+ENV NEXT_TELEMETRY_DISABLED=1
+
+COPY --from=builder /app/public ./public
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+
+EXPOSE 3000
+CMD ["node", "server.js"]
+
+FROM node:20-alpine AS dev
+WORKDIR /app
 COPY package*.json ./
 RUN npm install
-
 COPY . .
-
 EXPOSE 3000
 ENV NODE_ENV=development
 ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
-
 CMD ["npm", "run", "dev"]