chore(docker): stack compose with env_file, no secrets in repo

- docker-compose.stack.env for DB_* and CORS (gitignored)
- docker-compose.stack.env.example with placeholders
- .dockerignore excludes local stack env from build context

Made-with: Cursor

docker/nginx.frontend.conf

@@ -0,0 +1,21 @@
+server {
+  listen 80;
+  server_name _;
+  root /usr/share/nginx/html;
+  index index.html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+
+  # Браузер ходит на тот же origin: /api/* → бэкенд без префикса /api
+  location /api/ {
+    rewrite ^/api/(.*) /$1 break;
+    proxy_pass http://backend:3000;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}