feat(sprint-5): Phase 1 — Docker Compose full stack, CORS, Next.js upgrade

- Dockerfile.backend: multi-stage Java 21 build (eclipse-temurin)
- docker-compose.yml: PostgreSQL 16 + backend + frontend with health checks
- SecurityConfig: CORS for localhost:3000 frontend origin
- application-docker.properties: Docker profile with env vars
- Spring Boot Actuator health endpoint enabled
- Next.js upgraded 15.2.8 → 15.5.18 (security fixes)

cannamanage-api/src/main/resources/application-docker.properties

@@ -0,0 +1,19 @@
+# Docker profile — used when running in Docker Compose
+spring.datasource.url=${SPRING_DATASOURCE_URL}
+spring.datasource.username=${SPRING_DATASOURCE_USERNAME}
+spring.datasource.password=${SPRING_DATASOURCE_PASSWORD}
+
+# Enable Flyway for container startup (fresh DB)
+spring.flyway.enabled=true
+spring.jpa.hibernate.ddl-auto=validate
+
+# JWT secret from environment
+cannamanage.security.jwt.secret=${CANNAMANAGE_SECURITY_JWT_SECRET}
+
+# Actuator
+management.endpoints.web.exposure.include=health
+management.endpoint.health.show-details=never
+
+# Disable mail in Docker (no SMTP container)
+spring.mail.host=localhost
+spring.mail.port=1025