feat(infra): replace traefik path routing with nginx reverse proxy

- Add nginx service with /api, /ws, and / location routing
- Move traefik labels to proxy service only (port 80)
- Remove traefik labels from backend and frontend services
- Backend routes to :3001 via nginx upstream
- WebSocket upgrade enabled for /ws path

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/docker/docker-compose.yml

@@ -1,7 +1,26 @@
 version: '3.8'
 
 services:
-  # Backend Service (REST API + WebSocket via Traefik)
+  # Nginx Reverse Proxy — handles /api and /ws routing behind Traefik
+  proxy:
+    build:
+      context: .
+      dockerfile: Dockerfile.nginx
+    container_name: bete-proxy
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.bete.rule=Host(`imphnen.asepharyana.my.id`)"
+      - "traefik.http.routers.bete.entrypoints=websecure"
+      - "traefik.http.routers.bete.tls=true"
+      - "traefik.http.services.bete.loadbalancer.server.port=80"
+    depends_on:
+      - backend
+      - frontend
+    networks:
+      - app-shared-net
+
+  # Backend Service (REST API + WebSocket)
   backend:
     build:
       context: ..
@@ -12,13 +31,8 @@ services:
       - ../../.env
     environment:
       NODE_ENV: production
-      WEBSERVER_PORT: 3000
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.bete-backend.rule=Host(`imphnen.asepharyana.my.id`) && PathPrefix(`/api`, `/ws`)"
-      - "traefik.http.routers.bete-backend.entrypoints=websecure"
-      - "traefik.http.routers.bete-backend.tls=true"
-      - "traefik.http.services.bete-backend.loadbalancer.server.port=3000"
+      WEBSERVER_PORT: 3001
+    # No Traefik labels — nginx handles routing
     depends_on:
       - discord-gateway
     networks:
@@ -40,7 +54,7 @@ services:
     networks:
       - app-shared-net
 
-  # Frontend Service (React Dashboard via Traefik)
+  # Frontend Service (React Dashboard)
   frontend:
     build:
       context: ..
@@ -48,16 +62,10 @@ services:
     container_name: bete-frontend
     restart: unless-stopped
     environment:
-      VITE_API_URL: https://imphnen.asepharyana.my.id
-      VITE_WS_URL: wss://imphnen.asepharyana.my.id
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.bete-frontend.rule=Host(`imphnen.asepharyana.my.id`)"
-      - "traefik.http.routers.bete-frontend.entrypoints=websecure"
-      - "traefik.http.routers.bete-frontend.tls=true"
-      - "traefik.http.services.bete-frontend.loadbalancer.server.port=3000"
-    depends_on:
-      - backend
+      # Point to the same domain — nginx routes /api and /ws to backend
+      VITE_BE_API_URL: https://imphnen.asepharyana.my.id
+      VITE_BE_WS_URL: wss://imphnen.asepharyana.my.id
+    # No Traefik labels — nginx handles routing
     networks:
       - app-shared-net