feat: standalone frontend uses production build instead of dev server

[deardarlingoose]

User description

standalone version had ui problems:

• visible rect dev warnings on the ui
• accessible pages before pre-loaded server fully, made impression UI doesn't work 1st run sometimes

no-mistaken doc:

Override web service in docker-compose.standalone.yml to build from www/Dockerfile (multi-stage: deps → build → standalone runner) instead of running pnpm dev with bind-mounted source.

Description

Related Issue

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

---

PR Type

Enhancement

---

Description

• Production build for standalone frontend

• Eliminates dev warnings and UI issues

• Configures required environment variables

• Improves first-run experience

---

Changes walkthrough 📝

	Relevant files
Configuration changes	docker-compose.standalone.yml Configure production frontend for standalone mode                docker-compose.standalone.yml Adds new web service configuration using production build Sets up environment variables for standalone operation Configures server with node server.js instead of dev server Removes source code bind mounts for production deployment +24/-0

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[pr-agent-monadical]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Hardcoded secret: The PR introduces a hardcoded NEXTAUTH_SECRET value ("standalone-local-secret") on line 98. This secret is used for signing authentication tokens and cookies. Using a static, predictable secret in the configuration could make the application vulnerable if this configuration is used beyond local development environments. Consider implementing a mechanism to generate a unique secret for each deployment or providing clear documentation that this configuration is only for non-production use.

⚡ Recommended focus areas for review Security Concern The PR adds a hardcoded NEXTAUTH_SECRET value which is used for signing authentication tokens. Using a static secret in the configuration could be problematic if this value is meant to be unique per deployment. NEXTAUTH_SECRET: standalone-local-secret Configuration Validation The PR sets FEATURE_REQUIRE_LOGIN to "false" which disables authentication. Verify this is the intended behavior for the standalone mode and doesn't create any security implications. FEATURE_REQUIRE_LOGIN: "false"