chore(docker): multi-stage build and registry run template

Dockerfile builds the Vite app in an oven/bun stage and serves
dist/ from the same nginx:stable-alpine-perl base as before,
plus the runtime-config entrypoint scripts. .env stays
dockerignored, so CI builds carry no backend URL and the image
is env-independent. Custom /etc/nginx/nginx.conf mounts keep
working (separate path from /docker-entrypoint.d/).

docker-compose.example.yml is a prod run template for
git.linuxhg.com/games-database/games-frontend (IMAGE_TAG,
default latest) with VITE_API_URL env (including the /api
suffix), restart policy, and a wget / healthcheck; traefik
setups drop ports for their labels/networks.

docker-compose.example.yml

@@ -0,0 +1,25 @@
+---
+# Prod run template. The backend URL is injected at container start
+# (docker-entrypoint.d/30-frontend-config.sh), so the image carries no env.
+# Set VITE_API_URL including the /api suffix, e.g.:
+#   VITE_API_URL=https://gamesapi.linuxhg.com/api
+# Either inline below or via env_file .env (environment wins if both set).
+# Traefik setups: drop ports, add your labels/networks like the existing
+# games-frontend service; custom nginx.conf mounts keep working.
+services:
+  games-frontend:
+    image: git.linuxhg.com/games-database/games-frontend:${IMAGE_TAG:-latest}
+    container_name: games-frontend
+    restart: unless-stopped
+    environment:
+      - VITE_API_URL=
+    # env_file:
+    #   - .env
+    ports:
+      - 80:80
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost/ || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s