deploy: switch frontend to standalone production build

Frontend Dockerfile becomes multi-stage (deps/builder/production/dev)
with a Next.js standalone runtime and a 1GB heap cap to fit this host.
Compose targets the production stage, binds the frontend to
127.0.0.1:3001 for the 1Panel openresty proxy, drops dev volume
mounts and the publicly exposed postgres/backend ports, and passes
AUTH_URL/NEXTAUTH_URL/AUTH_TRUST_HOST so NextAuth works behind the
reverse proxy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -6,8 +6,6 @@ services:
       POSTGRES_USER: ${POSTGRES_USER:-evan}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-evanpass}
       POSTGRES_DB: ${POSTGRES_DB:-evanpage}
-    ports:
-      - "5432:5432"
     volumes:
       - pgdata:/var/lib/postgresql/data
     healthcheck:
@@ -31,8 +29,6 @@ services:
       AUTH_KEYCLOAK_ISSUER: ${AUTH_KEYCLOAK_ISSUER:-}
       AUTH_KEYCLOAK_ID: ${AUTH_KEYCLOAK_ID:-}
       AUTH_KEYCLOAK_SECRET: ${AUTH_KEYCLOAK_SECRET:-}
-    ports:
-      - "8080:8080"
     volumes:
       - ./backend:/app
       - /app/tmp
@@ -45,6 +41,7 @@ services:
   frontend:
     build:
       context: ./frontend
+      target: production
     container_name: evanpage-frontend
     environment:
       SERVER_API_URL: ${SERVER_API_URL:-http://backend:8080}
@@ -53,11 +50,11 @@ services:
       AUTH_KEYCLOAK_ISSUER: ${AUTH_KEYCLOAK_ISSUER:-}
       AUTH_KEYCLOAK_ID: ${AUTH_KEYCLOAK_ID:-}
       AUTH_KEYCLOAK_SECRET: ${AUTH_KEYCLOAK_SECRET:-}
+      AUTH_URL: ${AUTH_URL:-https://www.liukersun.com}
+      NEXTAUTH_URL: ${NEXTAUTH_URL:-https://www.liukersun.com}
+      AUTH_TRUST_HOST: ${AUTH_TRUST_HOST:-true}
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3001:3000"
-    volumes:
-      - ./frontend:/app
-      - /app/node_modules
     depends_on:
       - backend
     networks:

frontend/Dockerfile

@@ -1,15 +1,37 @@
-FROM node:20-alpine
+FROM node:20-alpine AS deps
-
 WORKDIR /app
+COPY package*.json ./
+RUN npm ci
 
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV NODE_OPTIONS=--max-old-space-size=1024
+RUN npm run build
+
+FROM node:20-alpine AS production
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+ENV NEXT_TELEMETRY_DISABLED=1
+
+COPY --from=builder /app/public ./public
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+
+EXPOSE 3000
+CMD ["node", "server.js"]
+
+FROM node:20-alpine AS dev
+WORKDIR /app
 COPY package*.json ./
 RUN npm install
-
 COPY . .
-
 EXPOSE 3000
 ENV NODE_ENV=development
 ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
-
 CMD ["npm", "run", "dev"]