phase 16: nginx-unprivileged on 8080, helm dashboard deployment

frontend/Dockerfile

@@ -9,9 +9,9 @@ ARG VITE_SYMBOL_REGISTRY_URL=""
 ARG VITE_RISK_ENGINE_URL=""
 RUN npm run build
 
-# Stage 2: Serve
-FROM nginx:alpine
+# Stage 2: Serve (unprivileged nginx, runs as uid 101, port 8080)
+FROM nginxinc/nginx-unprivileged:alpine
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
-EXPOSE 80
+EXPOSE 8080
 CMD ["nginx", "-g", "daemon off;"]

frontend/nginx.conf

@@ -1,5 +1,5 @@
 server {
-    listen 80;
+    listen 8080;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;