Fix LOW findings from 2026-09-24 maintenance review

- Frontend on nginx-unprivileged (non-root, container port 8080)
- Replace unmaintained passlib with bcrypt 5.0.0 (hash-compatible)
- Pass DOCS_ENABLED through to the backend container
- Raise db mem_limit to 768m for MySQL 8.4

Co-Authored-By: Claude Opus 5.5 <[email protected]>

frontend/Dockerfile

@@ -10,11 +10,13 @@ COPY . .
 RUN npm run build
 
 # Stage 2: Serve with nginx
-FROM nginx:1.30.5-alpine
+FROM nginxinc/nginx-unprivileged:1.30.5-alpine
 
+USER root
 RUN apk upgrade --no-cache
+USER nginx
 
 COPY --from=builder /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 
-EXPOSE 80
+EXPOSE 8080

frontend/nginx.conf

@@ -33,7 +33,7 @@ limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/m;
 limit_req_zone $binary_remote_addr zone=tv_limit:10m rate=10r/m;
 
 server {
-    listen 80;
+    listen 8080;
     server_tokens off;
     root /usr/share/nginx/html;
     index index.html;