Fix Dockerfile, httpOnly cookies, custom fields persistence and developer API keys

[RUKAYAT-CODER]

Summary

This PR addresses four frontend issues with small, focused changes:

#1620 - Add a Dockerfile and compose service for the frontend

• Created frontend/Dockerfile (multi-stage: deps, builder, standalone runner with non-root user and healthcheck).
• Set output: "standalone" in next.config.ts.
• Added a frontend service to docker-compose.yml with NEXT_PUBLIC_API_URL.

#1619 - Move tokens from localStorage to httpOnly cookies

• Updated store/auth.store.ts to remove all localStorage token writes and document.cookie manipulation.
• Tokens are now set as HttpOnly; Secure; SameSite=Lax cookies by the backend; the client sends withCredentials.

#1616 - Custom fields page persists via API

• Created lib/api/custom-fields.ts with a typed API client (list, create, update, delete, toggleActive).
• Updated settings/custom-fields/page.tsx to load and persist field definitions through the API on mount and on changes.

#1615 - Developer settings use API instead of Math.random

• Created lib/api/developer-settings.ts with a typed API client (list/create/revoke API keys, list/create/delete/test webhooks, rotate webhook secrets).
• Updated settings/developers/page.tsx to load keys/webhooks from the API and create them via API calls instead of generating secrets client-side with Math.random.

Closes #1620
Closes #1619
Closes #1616
Closes #1615

[drips-wave]

@RUKAYAT-CODER Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@RUKAYAT-CODER is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.