chore(docker): stack compose with env_file, no secrets in repo

- docker-compose.stack.env for DB_* and CORS (gitignored)
- docker-compose.stack.env.example with placeholders
- .dockerignore excludes local stack env from build context

Made-with: Cursor

Dockerfile.frontend

@@ -0,0 +1,15 @@
+# Сборка из корня монорепо: docker build -f Dockerfile.frontend .
+# SPA дергает API по префиксу /api (nginx проксирует на сервис backend:3000).
+FROM node:20-alpine AS build
+WORKDIR /app
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+COPY frontend/ ./
+ARG VITE_API_BASE_URL=/api
+ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
+RUN npm run build
+
+FROM nginx:alpine
+COPY --from=build /app/dist /usr/share/nginx/html
+COPY docker/nginx.frontend.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80