opt(deploy): multi-stage frontend (node→nginx), non-root user, healthchecks, resource limits

Frontend:
- Multi-stage build: builder (node:22-alpine) → runner (nginx:alpine)
  replaces vite preview (400MB RAM) with nginx static serving (<20MB RAM)
- New nginx-frontend.conf with gzip + long-term asset cache + SPA fallback

Backend & Discord Gateway:
- Add non-root user (USER app) for container security
- chown app files to avoid permission issues
- Add HEALTHCHECK: backend via /api/health, gateway via kill -0 1

Docker Compose:
- Remove unnecessary backend→gateway depends_on
- Add deploy.resources.limits.memory for all services
- Add healthchecks for all services

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com

infra/docker/Dockerfile.frontend

@@ -1,4 +1,5 @@
-FROM node:22-alpine
+# ---- Builder Stage ----
+FROM node:22-alpine AS builder
 
 ARG VITE_BE_API_URL
 ARG VITE_BE_WS_URL
@@ -25,8 +26,15 @@ RUN pnpm install --frozen-lockfile
 # Build frontend (env vars injected at build time)
 RUN VITE_BE_API_URL=${VITE_BE_API_URL} VITE_BE_WS_URL=${VITE_BE_WS_URL} pnpm --filter './services/frontend' run build
 
-# Expose port
+# ---- Runner Stage ----
+FROM nginx:alpine
+
+# Copy Nginx config
+COPY infra/docker/nginx/nginx-frontend.conf /etc/nginx/conf.d/default.conf
+
+# Copy built static files from builder stage
+COPY --from=builder /app/services/frontend/dist /usr/share/nginx/html
+
 EXPOSE 3000
 
-# Start frontend (production preview)
-CMD ["pnpm", "--filter", "./services/frontend", "run", "preview"]
+CMD ["nginx", "-g", "daemon off;"]