H-162: serve built frontend from Go image (#34)

Co-authored-by: Rogee <rogee@ipao.vip>

deploy/docker/Dockerfile

@@ -1,7 +1,19 @@
 # GoChat Dockerfile — Multi-stage build with security hardening
 # Reference: Chatwoot docker/Dockerfile multi-stage pattern + security best practices
 
-# ========== Build Stage ==========
+# ========== Frontend Build Stage ==========
+FROM node:22-alpine AS frontend-builder
+
+WORKDIR /app
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY frontend/package.json frontend/package.json
+RUN corepack enable && pnpm install --frozen-lockfile
+
+COPY frontend/ frontend/
+RUN pnpm --dir frontend test:build
+
+# ========== Go Build Stage ==========
 FROM golang:1.24-alpine AS builder
 
 # Build arguments for version injection
@@ -49,11 +61,14 @@ WORKDIR /app
 # Copy binary and configs from builder
 COPY --from=builder /gochat /app/gochat
 COPY --from=builder /gochat-worker /app/gochat-worker
+COPY --chown=gochat:gochat --from=frontend-builder /app/frontend/dist /app/frontend/dist
 COPY backend/configs/ /app/configs/
 COPY backend/migrations/ /app/migrations/
 
+ENV GOCHAT_FRONTEND_DIST=/app/frontend/dist
+
 # Set ownership to non-root user
-RUN mkdir -p /app/storage/uploads && chown -R gochat:gochat /app
+RUN mkdir -p /app/storage/uploads && chown -R gochat:gochat /app/storage
 
 # Switch to non-root user for security
 USER gochat