opt(deploy): multi-stage frontend (node→nginx), non-root user, healthchecks, resource limits

Frontend:
- Multi-stage build: builder (node:22-alpine) → runner (nginx:alpine)
  replaces vite preview (400MB RAM) with nginx static serving (<20MB RAM)
- New nginx-frontend.conf with gzip + long-term asset cache + SPA fallback

Backend & Discord Gateway:
- Add non-root user (USER app) for container security
- chown app files to avoid permission issues
- Add HEALTHCHECK: backend via /api/health, gateway via kill -0 1

Docker Compose:
- Remove unnecessary backend→gateway depends_on
- Add deploy.resources.limits.memory for all services
- Add healthchecks for all services

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com

infra/docker/Dockerfile.backend

@@ -5,17 +5,20 @@ WORKDIR /app
 # Install pnpm
 RUN npm install -g pnpm
 
+# Create non-root user
+RUN addgroup -S app && adduser -S -G app app
+
 # Copy workspace files
 COPY pnpm-workspace.yaml .
 COPY pnpm-lock.yaml .
 COPY package.json .
 
-# Copy packages (workspace dependencies)
-COPY packages/shared ./packages/shared
-
 # Copy patches (pnpm patchedDependencies)
 COPY patches ./patches
 
+# Copy packages (workspace dependencies)
+COPY packages/shared ./packages/shared
+
 # Copy service
 COPY services/backend ./services/backend
 
@@ -28,8 +31,18 @@ RUN pnpm --filter './packages/shared' run build
 # Build backend
 RUN pnpm --filter './services/backend' run build
 
+# Own dist + node_modules by non-root user
+RUN chown -R app:app /app
+
+# Switch to non-root user
+USER app
+
 # Expose port
-EXPOSE 3001
+EXPOSE 3000
+
+# Healthcheck — backend serves HTTP on port 3000
+HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
+  CMD wget -qO- http://localhost:3000/api/health || exit 1
 
 # Start backend
 CMD ["node", "services/backend/dist/index.js"]