Switch frontend container to production-aware runtime mode

doc/operations-and-configuration.md

@@ -139,9 +139,13 @@ Recommended LIVE pattern:
 ## Frontend Runtime
 
 - Frontend no longer consumes `VITE_API_TOKEN`.
+- Frontend startup mode is environment-driven:
+  - `APP_ENV=development` runs `vite dev`
+  - `APP_ENV=production` runs `vite build` then `vite preview`
 - Vite dev server host allowlist uses the union of:
   - hostnames extracted from `CORS_ORIGINS`
   - optional explicit hostnames from `VITE_ALLOWED_HOSTS`
+- The same host allowlist policy is applied to both Vite `server` and `preview`.
 - Session authentication is cookie-based; browser reloads and new tabs can reuse an active session until it expires or is revoked.
 - Protected media and file download flows still use authenticated fetch plus blob/object URL handling.
 

docker-compose.yml

@@ -151,6 +151,7 @@ services:
         NPM_FETCH_RETRY_MAXTIMEOUT: ${NPM_FETCH_RETRY_MAXTIMEOUT:-120000}
         NPM_FETCH_TIMEOUT: ${NPM_FETCH_TIMEOUT:-300000}
     environment:
+      APP_ENV: ${APP_ENV:-development}
       VITE_API_BASE: ${VITE_API_BASE:-}
       CORS_ORIGINS: '${CORS_ORIGINS:-["http://localhost:5173","http://localhost:3000"]}'
       VITE_ALLOWED_HOSTS: ${VITE_ALLOWED_HOSTS:-}

frontend/Dockerfile

@@ -23,9 +23,11 @@ COPY --chown=node:node tsconfig.node.json /app/tsconfig.node.json
 COPY --chown=node:node vite.config.ts /app/vite.config.ts
 COPY --chown=node:node index.html /app/index.html
 COPY --chown=node:node src /app/src
+COPY --chown=node:node docker-entrypoint.sh /app/docker-entrypoint.sh
+RUN chmod +x /app/docker-entrypoint.sh
 
 EXPOSE 5173
 
 USER node
 
-CMD ["npm", "run", "dev", "--", "--host", "0.0.0.0", "--port", "5173"]
+CMD ["/app/docker-entrypoint.sh"]

frontend/docker-entrypoint.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# Frontend runtime entrypoint.
+# Uses APP_ENV to select development or production Vite startup mode.
+
+set -eu
+
+APP_ENV_VALUE="${APP_ENV:-development}"
+HOST_VALUE="${FRONTEND_HOST:-0.0.0.0}"
+PORT_VALUE="${FRONTEND_PORT:-5173}"
+
+if [ "$APP_ENV_VALUE" = "production" ]; then
+  npm run build
+  exec npm run preview -- --host "$HOST_VALUE" --port "$PORT_VALUE"
+fi
+
+exec npm run dev -- --host "$HOST_VALUE" --port "$PORT_VALUE"

frontend/vite.config.ts

@@ -81,5 +81,10 @@ export default defineConfig(({ mode }) => {
       port: 5173,
       ...(allowedHosts ? { allowedHosts } : {}),
     },
+    preview: {
+      host: '0.0.0.0',
+      port: 5173,
+      ...(allowedHosts ? { allowedHosts } : {}),
+    },
   };
 });