fix: Docker security hardening

[ChinmayShringi]

Summary

• Multi-stage Dockerfile: separate build and runtime stages
• Run as non-root mirofish user
• Serve frontend with serve static server instead of Vite dev server
• Add HEALTHCHECK instruction to Dockerfile
• Add healthcheck config to docker-compose.yml
• Update .dockerignore with additional exclusions

Test plan

• docker compose build succeeds
• Container starts and healthcheck passes
• Frontend is served correctly on port 3000
• Backend API responds on port 5001

---

Original PR: 666ghj/MiroFish#232
Original Author: @0xNyk