Document production compose changes

PLAN.md

@@ -40,6 +40,7 @@
 - Added a Traefik compose override sample at `compose.traefik.yml.sample` for production routing and proxy-network attachment.
 - The production launcher now targets only `db`, `backend`, and `frontend`, keeping the dev Caddy proxy out of the production path.
 - The Caddy proxy service now runs only under the `dev` compose profile, and `scripts/dev-up.sh` enables that profile automatically.
+- The Traefik production override now builds the frontend into a static Nginx image and clears the dev-facing published ports.
 
 ## Storage Status
 - Backend media persists in the `backend-media` named Docker volume.

README.md

@@ -33,6 +33,7 @@ WalkUp is a collaborative baseball walk-up song app built as a React PWA with a
 
 ## Production
 - Copy `compose.traefik.yml.sample` to `compose.traefik.yml` and adjust it for your deployment.
+- The sample routes `backend` and `frontend` through Traefik, builds the frontend as a static Nginx image, and keeps the published ports off the host.
 - `./scripts/prod-up.sh` starts `db`, `backend`, and `frontend` in detached mode with that Traefik override.
 - Use `docker compose logs db backend frontend` when you need live service output from that detached stack.
 

frontend/Dockerfile.prod

@@ -0,0 +1,22 @@
+FROM node:22-alpine AS build
+
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci
+
+COPY . .
+
+ARG VITE_API_BASE_URL=/api
+ENV VITE_API_BASE_URL=${VITE_API_BASE_URL}
+
+RUN npm run build
+
+FROM nginx:1.27-alpine
+
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/dist /usr/share/nginx/html
+
+EXPOSE 80
+
+CMD ["nginx", "-g", "daemon off;"]

frontend/nginx.conf

@@ -0,0 +1,15 @@
+server {
+  listen 80;
+  server_name _;
+  root /usr/share/nginx/html;
+  index index.html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+
+  location /assets/ {
+    add_header Cache-Control "public, max-age=31536000, immutable";
+    try_files $uri =404;
+  }
+}