fix: Docker security hardening

[0xNyk]

Summary

• Multi-stage Dockerfile: separate build and runtime stages
• Run as non-root mirofish user
• Serve frontend with serve static server instead of Vite dev server
• Add HEALTHCHECK instruction to Dockerfile
• Add healthcheck config to docker-compose.yml
• Update .dockerignore with additional exclusions

Test plan

• docker compose build succeeds
• Container starts and healthcheck passes
• Frontend is served correctly on port 3000
• Backend API responds on port 5001

[0xNyk]

Verification

All checks pass on merged code:

Test	Result
HEALTHCHECK in Dockerfile	✅ PASS
Non-root USER mirofish in Dockerfile	✅ PASS
Static serve replaces dev server	✅ PASS
Healthcheck in docker-compose.yml	✅ PASS
Multi-stage build (3 stages)	✅ PASS