sciagent code + Gitea Actions CI/CD

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend_user/Dockerfile.prod

@@ -0,0 +1,35 @@
+# Production image for the applicant SPA (frontend_user).
+# Multi-stage: build the minified bundle in the npm workspace, then serve it with nginx.
+# The runtime image holds ONLY static files — no Node, no source, no Vite dev server — so
+# end users inspecting the app see a minified bundle, never the original TypeScript.
+#
+# Build context = repo ROOT (the npm workspace):
+#   docker build -f frontend_user/Dockerfile.prod -t frontend_user .
+
+# ---- build stage ----
+FROM node:22-alpine AS build
+WORKDIR /app
+
+# Workspace manifests first (layer cache); all three are needed for `npm ci` to resolve.
+COPY package.json package-lock.json ./
+COPY shared/package.json ./shared/
+COPY frontend_user/package.json ./frontend_user/
+COPY frontend_admin/package.json ./frontend_admin/
+COPY frontend_investigator/package.json ./frontend_investigator/
+COPY frontend_publisher/package.json ./frontend_publisher/
+RUN npm ci
+
+# Only the sources this app needs: the applicant app + the shared kernel (consumed as source).
+COPY shared ./shared
+COPY frontend_user ./frontend_user
+
+# Vite production build → /app/frontend_user/dist (minified, sourcemap:false).
+RUN npm run build -w frontend_user
+
+# ---- runtime stage (static only) ----
+FROM nginx:1.27-alpine
+RUN rm -rf /usr/share/nginx/html/*
+COPY frontend_user/nginx/default.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/frontend_user/dist /usr/share/nginx/html
+EXPOSE 8080
+CMD ["nginx", "-g", "daemon off;"]