feat(sprint-5): Phase 1 — Docker Compose full stack, CORS, Next.js upgrade

- Dockerfile.backend: multi-stage Java 21 build (eclipse-temurin)
- docker-compose.yml: PostgreSQL 16 + backend + frontend with health checks
- SecurityConfig: CORS for localhost:3000 frontend origin
- application-docker.properties: Docker profile with env vars
- Spring Boot Actuator health endpoint enabled
- Next.js upgraded 15.2.8 → 15.5.18 (security fixes)

Dockerfile.backend

@@ -0,0 +1,38 @@
+# Multi-stage build for cannamanage-api (Spring Boot + Java 21)
+# Build context: repo root (needs access to all Maven modules)
+
+FROM eclipse-temurin:21-jdk-alpine AS builder
+WORKDIR /app
+
+# Copy Maven wrapper + POM files first (layer caching)
+COPY .mvn/ .mvn/
+COPY mvnw pom.xml ./
+COPY cannamanage-domain/pom.xml cannamanage-domain/pom.xml
+COPY cannamanage-service/pom.xml cannamanage-service/pom.xml
+COPY cannamanage-api/pom.xml cannamanage-api/pom.xml
+
+# Download dependencies (cached unless POMs change)
+RUN chmod +x mvnw && ./mvnw dependency:go-offline -B -q 2>/dev/null || true
+
+# Copy source code
+COPY cannamanage-domain/src/ cannamanage-domain/src/
+COPY cannamanage-service/src/ cannamanage-service/src/
+COPY cannamanage-api/src/ cannamanage-api/src/
+
+# Build the fat JAR
+RUN ./mvnw package -pl cannamanage-api -am -DskipTests -B -q
+
+# --- Runtime stage ---
+FROM eclipse-temurin:21-jre-alpine AS runtime
+WORKDIR /app
+
+# Create non-root user
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+
+COPY --from=builder /app/cannamanage-api/target/*.jar app.jar
+
+USER appuser
+
+EXPOSE 8080
+
+ENTRYPOINT ["java", "-jar", "app.jar"]