chore: 同步前端仓库最新打包配置与依赖

web/Dockerfile

@@ -1,5 +1,23 @@
-FROM docker.m.daocloud.io/nginx:alpine
-# nginx.k8s.conf is rendered by Jenkins from
-# .docker-compose/nginx/conf.d/my.conf (envsubst '$KRA_APP').
-COPY nginx.k8s.conf /etc/nginx/conf.d/default.conf
-COPY dist /usr/share/nginx/html
+# 与服务器 deploy.sh 对齐：
+#   docker build --build-arg VERSION=$TAG -t sw2/frontend:$TAG .
+#   docker run --rm --add-host sw2-backend:127.0.0.1 sw2/frontend:$TAG nginx -t
+# 运行阶段与部署侧 frontend.Dockerfile 一致。本仓库在镜像内编译，
+# 产物对应部署侧的 COPY dist/。
+
+FROM docker.m.daocloud.io/library/node:20-alpine AS build
+WORKDIR /src
+ENV COREPACK_NPM_REGISTRY=https://registry.npmmirror.com
+RUN corepack enable && corepack prepare pnpm@9.15.9 --activate
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm config set registry https://registry.npmmirror.com \
+    && pnpm install --frozen-lockfile
+COPY . .
+RUN pnpm run build
+
+FROM docker.m.daocloud.io/nginx:1.28-alpine@sha256:a8b39bd9cf0f83869a2162827a0caf6137ddf759d50a171451b335cecc87d236
+ARG VERSION
+LABEL org.opencontainers.image.revision=$VERSION
+COPY nginx.sw2.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /src/dist /usr/share/nginx/html/
+HEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=3 \
+    CMD wget -q -O /dev/null http://127.0.0.1/healthz || exit 1