enable dev|prod envs with simpler env vars system

docker/Dockerfile

@@ -1,7 +1,7 @@
 # ── Build stage ──────────────────────────────────────────
 FROM node:22-alpine AS builder
-ARG PUBLIC_PB_URL=/pb
-ENV PUBLIC_PB_URL=$PUBLIC_PB_URL
+# Browser → PB goes through nginx at /pb (same origin) — fixed for docker.
+# ENV PUBLIC_PB_URL=/pb
 RUN corepack enable
 WORKDIR /app
 COPY . .
@@ -11,9 +11,9 @@ RUN pnpm --filter proxy build
 
 # ── Runtime stage ────────────────────────────────────────
 FROM node:22-alpine
-ARG PUBLIC_PB_URL=/pb
-ENV PUBLIC_PB_URL=$PUBLIC_PB_URL
-ENV PB_ENDPOINT=http://127.0.0.1:8090
+# Browser → PB goes through nginx at /pb (same origin). PB_ENDPOINT (server →
+# PB) is a loopback constant in the app code, not an env var.
+# ENV PUBLIC_PB_URL=/pb
 RUN corepack enable && apk add --no-cache nginx wget unzip ca-certificates
 WORKDIR /app
 COPY --from=builder /app/frontend/build ./frontend/build
@@ -27,7 +27,10 @@ RUN wget -qO /tmp/pb.zip https://github.com/pocketbase/pocketbase/releases/downl
     && unzip -o /tmp/pb.zip -d /usr/local/bin/ \
     && rm /tmp/pb.zip
 RUN chmod +x /entrypoint.sh /usr/local/bin/pocketbase
-ENV FRONTEND_PORT=2080
-ENV PROXY_PORT=3456
-EXPOSE 3001 8090
+# ENV FRONTEND_PORT=2080
+# ENV PROXY_PORT=3456
+# Public entrypoint. The host port is chosen at deploy time via compose PORT;
+# EXPOSE here is documentation only (nginx listens on 3001). PB (8090) stays
+# internal — never published from the image.
+EXPOSE 3000 8090
 CMD ["/entrypoint.sh"]