opt(deploy): multi-stage frontend (node→nginx), non-root user, healthchecks, resource limits

Frontend:
- Multi-stage build: builder (node:22-alpine) → runner (nginx:alpine)
  replaces vite preview (400MB RAM) with nginx static serving (<20MB RAM)
- New nginx-frontend.conf with gzip + long-term asset cache + SPA fallback

Backend & Discord Gateway:
- Add non-root user (USER app) for container security
- chown app files to avoid permission issues
- Add HEALTHCHECK: backend via /api/health, gateway via kill -0 1

Docker Compose:
- Remove unnecessary backend→gateway depends_on
- Add deploy.resources.limits.memory for all services
- Add healthchecks for all services

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com

infra/docker/nginx/nginx-frontend.conf

@@ -0,0 +1,24 @@
+# Nginx config for serving Vite-built static frontend files
+server {
+    listen 3000;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Gzip compression for faster load times
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript image/svg+xml;
+    gzip_min_length 256;
+
+    # Cache static assets (JS/CSS hashed filenames)
+    location /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # SPA fallback — all non-file routes serve index.html
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}