feat(devops): Docker multi-stage production build optimization & security hardening (#1335)

[nemeregiftbrown-byte]

Summary

Closes #1335.

Production images for the FlowFi backend and frontend are now multi-stage, run as a non-root user, and expose a native Docker healthcheck — plus the Compose stack builds and runs the frontend.

Backend — backend/Dockerfile

• Kept the multi-stage builder → runner split on the pinned node:20-alpine digest.
• Runs as the non-root node user (USER node).
• Added HEALTHCHECK polling http://127.0.0.1:3001/health.
• CMD ["node", "dist/index.js"] instead of npm start, so the server is PID 1 and receives SIGTERM/SIGINT for the graceful-shutdown handler in src/index.ts.
• COPY --chown=node:node (no extra chown -R layer), npm cache clean, dropped the redundant duplicate prisma copy.

Frontend — frontend/Dockerfile (new) + frontend/next.config.ts

• Enabled Next.js output: "standalone" (the issue's requirement).
• Multi-stage build whose runner copies only .next/standalone + .next/static + public — never the workspace node_modules.
• Non-root node user + native HEALTHCHECK on /health.
• Added a dependency-free frontend/src/app/health/route.ts.
• NEXT_PUBLIC_* accepted as build args (they are inlined into the client bundle at build time).

Compose & build context — docker-compose.yml, root .dockerignore

• New frontend service with build context at the repo root so the standalone monorepo layout (frontend/server.js) is preserved; depends_on: backend (healthy).
• Healthchecks on backend and frontend, with start_period for warm-up.
• Probes hit 127.0.0.1 deliberately: busybox wget resolves localhost to IPv6 ::1 first, which the IPv4-bound servers do not answer.
• Root .dockerignore keeps the context lean (.git, node_modules, build output, tests, docs, contracts).

Verification

Frontend image built and run locally:

• docker build -f frontend/Dockerfile . → success
• State.Health.Status → healthy; GET /health → 200 {"status":"ok"}; GET / → 200
• runs as uid=1000(node)
• size: 282 MB uncompressed / ~67 MB compressed

Backend Dockerfile parses and its dependency/COPY stages run; the final npm run build step fails on a pre-existing prisma/tsc breakage on main (see below), not on the Dockerfile itself.

Pre-existing blockers on main (NOT introduced here)

While verifying I found main is already broken in ways unrelated to #1335:

1. backend/prisma/schema.prisma declares IndexerDeadLetterEvent twice, and two migrations create the same table (bad merge 38a3e2d). prisma generate therefore fails → the backend image cannot build until this is resolved.
2. backend/package.json requires @stellar/stellar-sdk@^17.0.1 while the committed lockfile resolves 15.1.0 (commit 4a8009c), and the code was not migrated to the v17 API — so npm ci fails the sync check and tsc reports 76 errors in the backend / 19 in the frontend.
3. Because of (2), next build currently fails on pre-existing frontend type errors; the frontend image was validated with a temporary, uncommitted typescript.ignoreBuildErrors override so the Dockerfile itself could be exercised.

Size note: node:20-alpine alone is ~194 MB uncompressed and the backend's production dependency tree is ~516 MB, so the < 150 MB target is not reachable for the backend without dependency pruning/bundling — suggested as a follow-up.

Test plan

docker compose build
docker compose up -d
curl -fsS http://localhost:3001/health
curl -fsS http://localhost:3000/health
docker inspect --format '{{.State.Health.Status}}' flowfi-backend flowfi-frontend