fix(frontend): bind Next standalone to 0.0.0.0 so healthcheck passes

Docker auto-sets HOSTNAME to the container id; Next standalone's server.js
binds process.env.HOSTNAME, so it listened on the container hostname and the
compose healthcheck (TCP 127.0.0.1:3000) was refused → frontend container
chronically "(unhealthy)" (cosmetic: Caddy reaches it by service name and the
site serves 200). Pin HOSTNAME=0.0.0.0 — the canonical Next.js Docker fix.
Diagnosed on prod 2026-06-05.

frontend/Dockerfile

@@ -27,9 +27,15 @@ RUN npm run build
 # ---- runner ----
 FROM node:20-alpine AS runner
 WORKDIR /app
+# Next.js standalone server.js binds to `process.env.HOSTNAME || '0.0.0.0'`.
+# Docker auto-sets HOSTNAME to the container id, so without this the server binds
+# that hostname and the compose healthcheck (TCP 127.0.0.1:3000) is refused →
+# container shows "(unhealthy)" although it serves fine via Caddy (service name).
+# Pin 0.0.0.0 so it listens on all interfaces and the healthcheck connects.
 ENV NODE_ENV=production \
     NEXT_TELEMETRY_DISABLED=1 \
-    PORT=3000
+    PORT=3000 \
+    HOSTNAME=0.0.0.0
 
 # `node` user (uid 1000) ships with the alpine image.
 COPY --from=builder --chown=node:node /app/public ./public