feat(frontend): add production stage to Dockerfile

Multi-stage Dockerfile with three targets:
- development (dev server on :5173, used by docker-compose.yml)
- build (runs npm run build, produces SvelteKit Node-adapter output)
- production (self-contained node build server on :3000)

Node base pinned to node:20.19.0-alpine3.21 for reproducible CI
builds (Renovate will keep it current).

docker-compose.yml now specifies target: development for the
frontend so dev continues to use the dev-server stage. Without
this, Docker would default to the last stage (production).

Refs #497.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/Dockerfile

@@ -1,15 +1,34 @@
-FROM node:20-alpine
+# syntax=docker/dockerfile:1.7
 
+# ── Development ──────────────────────────────────────────────────────────────
+# Used by docker-compose.yml (target: development). Source is bind-mounted in
+# dev so the COPY . below is effectively replaced at runtime; the layer still
+# exists so the image is self-contained for cold starts (e.g. devcontainer).
+FROM node:20.19.0-alpine3.21 AS development
 WORKDIR /app
-
-# Install dependencies as a separate layer so they are cached when only source changes
 COPY package.json package-lock.json ./
 RUN npm ci
-
-# Source is mounted at runtime via docker-compose volume
-# This COPY is only used when building without a volume (e.g. production image)
 COPY . .
-
 EXPOSE 5173
-
 CMD ["npm", "run", "dev"]
+
+# ── Build ────────────────────────────────────────────────────────────────────
+# Compiles the SvelteKit Node-adapter output to /app/build.
+FROM node:20.19.0-alpine3.21 AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+# ── Production ───────────────────────────────────────────────────────────────
+# Self-contained Node server. `node build` is the adapter-node entrypoint.
+FROM node:20.19.0-alpine3.21 AS production
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=build /app/build ./build
+COPY --from=build /app/package.json ./package.json
+COPY --from=build /app/package-lock.json ./package-lock.json
+RUN npm ci --omit=dev
+EXPOSE 3000
+CMD ["node", "build"]