feat: separate frontend container (Axum static serving + API proxy)

A dedicated Rust/Axum binary (web/frontend-server/) that:
- Serves the built Vite SPA bundle from dist/ via tower-http ServeDir
- Falls back to index.html for SPA routing (deep links work)
- Reverse-proxies /api/* to the backend container (same-origin, no CORS)
- Listens on port 8080 (configurable via FRONTEND_PORT)

Dockerfile (web/normogen-web/Dockerfile): 3-stage build:
1. Node: npm ci + npm run build -> dist/
2. Rust: cargo build --release the frontend-server binary
3. Runtime: debian-slim + binary + dist/

docker-compose.yml: new 'frontend' service on :8080, depends on backend healthy,
proxies to http://backend:6500. Independently scalable (run N replicas behind
a load balancer).

Architecture:
  Browser -> :8080 (frontend container)
    /api/* -> proxy -> backend:6500
    /*     -> static dist/ (SPA)

backend/docker-compose.yml

@@ -42,5 +42,25 @@ services:
       retries: 3
       start_period: 40s
 
+  frontend:
+    build:
+      context: ../web/normogen-web
+    container_name: normogen-frontend
+    restart: unless-stopped
+    ports:
+      - "8080:8080"
+    environment:
+      - BACKEND_URL=http://backend:6500
+      - FRONTEND_PORT=8080
+    depends_on:
+      backend:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
 volumes:
   mongodb_data: