deploy: combined Dockerfile — FastAPI serves the SPA in prod

Three-stage build:
  1. node:22-alpine — `npm ci` + `npm run build` produces frontend/dist
  2. python:3.12-slim — poetry installs backend deps into a venv
  3. python:3.12-slim — runtime, copies the venv + frontend/dist,
     sets FRONTEND_DIST=/app/frontend_dist

Backend gates the API surface on FRONTEND_DIST:

- Unset (dev / tests): routers mount at root (/networth, /scenarios,
  …). 172 tests still pass unchanged. The Vite dev server proxies
  `/api/*` → backend stripping the prefix.
- Set (prod): routers mount under `/api/*`. The SPA bundle mounts at
  `/` with html=True so React Router owns client routing for paths
  like `/scenarios`, `/what-if`. Same-origin, no CORS, one deploy.

Operational endpoints (`/healthz`, `/metrics`, `/recompute`) stay at
root in both shapes.

Existing Woodpecker pipeline picks this up unchanged — same context,
same Dockerfile path, just produces a richer image.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile

@@ -1,4 +1,17 @@
-FROM python:3.12-slim AS builder
+# ── Stage 1: build the React SPA ─────────────────────────────────────
+FROM node:22-alpine AS frontend-builder
+
+WORKDIR /frontend
+
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+
+COPY frontend/ ./
+RUN npm run build
+
+
+# ── Stage 2: install backend Python deps ─────────────────────────────
+FROM python:3.12-slim AS backend-builder
 
 ENV POETRY_VERSION=1.8.4 \
     POETRY_VIRTUALENVS_IN_PROJECT=true \
@@ -16,16 +29,19 @@ COPY alembic.ini ./alembic.ini
 RUN poetry install --only main
 
 
+# ── Stage 3: runtime ─────────────────────────────────────────────────
 FROM python:3.12-slim
 
 WORKDIR /app
 
 RUN useradd --system --uid 10003 --home /app --shell /usr/sbin/nologin firep
 
-COPY --from=builder --chown=firep:firep /app /app
+COPY --from=backend-builder --chown=firep:firep /app /app
+COPY --from=frontend-builder --chown=firep:firep /frontend/dist /app/frontend_dist
 
 ENV PATH="/app/.venv/bin:${PATH}" \
-    PYTHONUNBUFFERED=1
+    PYTHONUNBUFFERED=1 \
+    FRONTEND_DIST=/app/frontend_dist
 
 EXPOSE 8080
 USER firep