build(docker): add runtime-configured frontend image

docker/frontend.Dockerfile

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1
+FROM node:22.19.0-bookworm-slim AS build
+WORKDIR /src/frontend
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY frontend/ ./
+RUN npm run build
+
+FROM nginxinc/nginx-unprivileged:1.27-alpine
+USER root
+COPY --from=build /src/frontend/dist /usr/share/nginx/html
+COPY docker/nginx.conf.template /etc/nginx/conf.d/default.conf
+COPY docker/frontend-entrypoint.sh /usr/local/bin/frontend-entrypoint
+RUN mv /usr/share/nginx/html/config.js /usr/share/nginx/html/config.template.js \
+    && sed -i 's|{}|{ backendBaseUrl: "__BACKEND_BASE_URL__" }|' /usr/share/nginx/html/config.template.js \
+    && chmod 0555 /usr/local/bin/frontend-entrypoint \
+    && chown -R 101:101 /usr/share/nginx/html
+
+EXPOSE 8080
+USER 101:101
+ENTRYPOINT ["/usr/local/bin/frontend-entrypoint"]