Fix LOW findings from 2026-09-24 maintenance review

- Frontend on nginx-unprivileged (non-root, container port 8080)
- Replace unmaintained passlib with bcrypt 5.0.0 (hash-compatible)
- Pass DOCS_ENABLED through to the backend container
- Raise db mem_limit to 768m for MySQL 8.4

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docker-compose.yml

@@ -24,7 +24,7 @@ services:
       timeout: 5s
       retries: 5
       start_period: 180s
-    mem_limit: 512m
+    mem_limit: 768m
     cpus: 1.0
     logging: *default-logging
 
@@ -43,6 +43,7 @@ services:
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
       NTFY_URL: ${NTFY_URL:-}
       NTFY_TOKEN: ${NTFY_TOKEN:-}
+      DOCS_ENABLED: ${DOCS_ENABLED:-false}
     depends_on:
       db:
         condition: service_healthy
@@ -63,13 +64,13 @@ services:
     container_name: homeschool_frontend
     restart: unless-stopped
     ports:
-      - "8054:80"
+      - "8054:8080"
     depends_on:
       - backend
     networks:
       - homeschool_net
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/"]
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/"]
       interval: 30s
       timeout: 5s
       retries: 3