fix: edge hardening, rootless containers, fail-closed frontend mode

docker-compose.yml

@@ -53,8 +53,9 @@ services:
       - path: .env
         required: false
     environment:
-      # Dev default (HMR); prod .env sets `preview` (build + serve bundle).
-      FRONTEND_MODE: ${FRONTEND_MODE:-dev}
+      # Fail closed: unset means the production preview server. Dev sets
+      # FRONTEND_MODE=dev in .env (provisioned by .devcontainer/setup.sh).
+      FRONTEND_MODE: ${FRONTEND_MODE:-preview}
     volumes:
       # No node_modules volume by design: deps live in the bind-mount and the
       # entrypoint runs `npm ci` on first start (a volume used to shadow the