devops: optimize frontend Dockerfile for production

[AnnieIj]

Summary

Hardens the multi-stage frontend Dockerfile to run as a non-root user.

Changes

• Add USER nginx so the container runs as the unprivileged nginx user
• Fix /var/run/nginx.pid ownership so nginx can start under that user

Acceptance Criteria

• Stage 1 builds the React app with Node.js
• Stage 2 serves built assets with Nginx Alpine
• Final image contains no Node.js or source files
• Nginx config serves index.html for all routes (SPA routing)
• Image builds successfully with docker build

Closes #318

[drips-wave]

@AnnieIj Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits