opt(deploy): multi-stage frontend (node→nginx), non-root user, healthchecks, resource limits

Frontend:
- Multi-stage build: builder (node:22-alpine) → runner (nginx:alpine)
  replaces vite preview (400MB RAM) with nginx static serving (<20MB RAM)
- New nginx-frontend.conf with gzip + long-term asset cache + SPA fallback

Backend & Discord Gateway:
- Add non-root user (USER app) for container security
- chown app files to avoid permission issues
- Add HEALTHCHECK: backend via /api/health, gateway via kill -0 1

Docker Compose:
- Remove unnecessary backend→gateway depends_on
- Add deploy.resources.limits.memory for all services
- Add healthchecks for all services

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com

infra/docker/Dockerfile.discord-gateway

@@ -5,6 +5,9 @@ WORKDIR /app
 # Install pnpm
 RUN npm install -g pnpm
 
+# Create non-root user
+RUN addgroup -S app && adduser -S -G app app
+
 # Copy workspace files
 COPY pnpm-workspace.yaml .
 COPY pnpm-lock.yaml .
@@ -37,5 +40,17 @@ RUN pnpm --filter './services/discord-gateway' run build
 # Create recordings directory
 RUN mkdir -p /app/recordings
 
+# Own everything by non-root user
+RUN chown -R app:app /app
+
+# Switch to non-root user
+USER app
+
+# Expose no HTTP port (gateway is internal-only)
+
+# Healthcheck — verify PID 1 (node) is still running (no HTTP server in this service)
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD sh -c "kill -0 1"
+
 # Start discord gateway
 CMD ["node", "services/discord-gateway/dist/index.js"]