Add rate limiting, security headers, fix CORS for production

backend/Dockerfile

@@ -0,0 +1,39 @@
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+COPY package.json package-lock.json* ./
+RUN npm ci
+
+COPY tsconfig.json ./
+COPY prisma ./prisma
+COPY src ./src
+
+RUN npx prisma generate
+RUN npm run build
+
+# --- Runtime stage ---
+FROM node:20-alpine AS runner
+
+# Install OpenSSL libraries required by Prisma
+RUN apk add --no-cache openssl libssl3
+
+RUN addgroup --gid 1001 appgroup && \
+    adduser -D -u 1001 -G appgroup appuser
+
+WORKDIR /app
+
+COPY package.json package-lock.json* ./
+RUN npm ci --omit=dev
+
+COPY --from=builder /app/dist ./dist
+COPY prisma ./prisma
+RUN npx prisma generate
+
+RUN chown -R appuser:appgroup /app
+
+USER appuser
+
+EXPOSE 3007
+
+CMD ["node", "dist/index.js"]