feat: production docker + documentation

- Backend Dockerfile: multi-stage build with venv, gunicorn+uvicorn workers, entrypoint runs alembic then gunicorn
- Frontend Dockerfile: multi-stage with npm ci, nginx:1.27-alpine runtime
- nginx.conf: gzip compression, security headers (X-Frame-Options, X-Content-Type-Options, etc.), static asset caching, correct API proxy preserving /api/ prefix
- docker-compose.yml: production config — db healthcheck, backend healthcheck, frontend depends_on backend healthy, no exposed backend port
- docker-compose.override.yml: dev hot-reload — uvicorn --reload with source mount, npm run dev on port 5173
- Rate limiting: slowapi middleware on /auth/login (10/min) and /auth/register (5/min)
- README.md: full documentation with architecture, quick start, API table, dev/prod instructions, tests
- .env.example: all variables documented with comments
- .gitignore: extended with *.pyc, *.cover, .ruff_cache, frontend/.vite, etc.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -1,17 +1,26 @@
-# ── PostgreSQL ──────────────────────────────────────────
+# ── PostgreSQL ──────────────────────────────────────────────────────────────
 POSTGRES_USER=budget
 POSTGRES_PASSWORD=budget
 POSTGRES_DB=budget_tracker
-DB_PORT=5432
 
-# ── Backend (FastAPI) ──────────────────────────────────
+# ── Backend (FastAPI) ───────────────────────────────────────────────────────
+# Full connection URL — built from the vars above by docker-compose
 DATABASE_URL=postgresql+asyncpg://budget:budget@db:5432/budget_tracker
+
+# IMPORTANT: generate a strong random key for production
+# python -c "import secrets; print(secrets.token_hex(32))"
 SECRET_KEY=change-me-in-production
+
 ACCESS_TOKEN_EXPIRE_MINUTES=15
 REFRESH_TOKEN_EXPIRE_DAYS=7
-CORS_ORIGINS=["http://localhost:5173","http://localhost:3000"]
-DEBUG=false
-BACKEND_PORT=8000
 
-# ── Frontend ───────────────────────────────────────────
-FRONTEND_PORT=3000
+# Comma-separated list of allowed origins (JSON array syntax)
+# Production: set to your actual frontend domain, e.g. ["https://budget.example.com"]
+CORS_ORIGINS=["http://localhost"]
+
+# ── Ports (override for local conflicts) ────────────────────────────────────
+# Production: frontend is exposed on port 80 (FRONTEND_PORT)
+FRONTEND_PORT=80
+# Dev only:
+DB_PORT=5432
+BACKEND_PORT=8000