feat: fix registration 500, add forgot-password flow, frontend validation

- Fix MissingGreenlet: sync_engine now uses psycopg2 instead of asyncpg
- Fix bcrypt/passlib compat: pin bcrypt<4.1 in requirements
- Fix legacy password_hash NOT NULL: alter column to nullable in migration
- Add frontend password validation (uppercase + lowercase + digit)
- Add forgot-password and reset-password backend endpoints
- Add forgot-password and reset-password frontend pages
- Add email_service.py (SMTP via admin settings)
- Add reset_token/reset_token_expires columns to User model
- Migrate legacy JSON-only users to DB on password reset request
- Mount data/ volume in docker-compose.local.yml for persistence
- Add production deployment config (Dockerfile, nginx, deploy.sh)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker/frontend/Dockerfile

@@ -1,49 +1,55 @@
-# Document Translation Frontend - Dockerfile
+# Office Translator - Frontend Dockerfile
 # Multi-stage build for optimized production
 
-# Build stage
+# ---- Build stage ----
 FROM node:20-alpine AS builder
 
 WORKDIR /app
 
-# Copy package files
+# Copy package files first (better layer caching)
 COPY frontend/package*.json ./
 
-# Install dependencies
-RUN npm ci --only=production=false
+# Install ALL dependencies (dev needed for build)
+RUN npm install
 
 # Copy source code
 COPY frontend/ .
 
-# Build arguments for environment
-ARG NEXT_PUBLIC_API_URL=http://localhost:8000
+# Build arguments
+# NEXT_PUBLIC_API_URL: client-side API base (empty = relative URLs via proxy)
+# BACKEND_URL: server-side proxy target (must be resolvable from container)
+ARG NEXT_PUBLIC_API_URL=
+ARG BACKEND_URL=http://backend:8000
 ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
+ENV BACKEND_URL=${BACKEND_URL}
 
-# Build the application
+# Build the application (with standalone output)
 RUN npm run build
 
-# Production stage
+# ---- Production stage ----
 FROM node:20-alpine AS production
 
 WORKDIR /app
 
+# Set NODE_ENV before copying
+ENV NODE_ENV=production
+
 # Create non-root user
 RUN addgroup -g 1001 -S nodejs && \
     adduser -S nextjs -u 1001
 
-# Copy built assets from builder
+# Copy standalone output from builder
 COPY --from=builder /app/public ./public
 COPY --from=builder /app/.next/standalone ./
 COPY --from=builder /app/.next/static ./.next/static
 
-# Set correct permissions
+# Set correct ownership
 RUN chown -R nextjs:nodejs /app
 
 USER nextjs
 
-# Environment
-ENV NODE_ENV=production \
-    PORT=3000 \
+# Runtime environment
+ENV PORT=3000 \
     HOSTNAME="0.0.0.0"
 
 EXPOSE 3000

docker/frontend/server.js

@@ -0,0 +1,66 @@
+/**
+ * Custom Next.js standalone server.
+ * Proxies /api/* requests to BACKEND_URL (resolved at RUNTIME, not build time).
+ * This is needed because next.config.ts rewrites are baked in at build time.
+ */
+const { createServer } = require("http");
+const { parse } = require("url");
+const next = require("next");
+
+const port = parseInt(process.env.PORT || "3000", 10);
+const hostname = process.env.HOSTNAME || "0.0.0.0";
+const dev = process.env.NODE_ENV !== "production";
+
+const backendUrl = (process.env.BACKEND_URL || "http://127.0.0.1:8000").replace(/\/$/, "");
+
+const app = next({ dev, hostname, port });
+const handle = app.getRequestHandler();
+
+app.prepare().then(() => {
+  createServer(async (req, res) => {
+    try {
+      const parsedUrl = parse(req.url, true);
+      const { pathname } = parsedUrl;
+
+      // Proxy /api/* to backend
+      if (pathname.startsWith("/api/")) {
+        const http = require("http");
+        const targetUrl = new URL(req.url, backendUrl);
+
+        const proxyReq = http.request(
+          targetUrl,
+          {
+            method: req.method,
+            headers: {
+              ...req.headers,
+              host: targetUrl.host,
+            },
+          },
+          (proxyRes) => {
+            res.writeHead(proxyRes.statusCode, proxyRes.headers);
+            proxyRes.pipe(res, { end: true });
+          }
+        );
+
+        proxyReq.on("error", (err) => {
+          console.error(`Proxy error for ${req.url}:`, err.message);
+          res.writeHead(502);
+          res.end("Bad Gateway");
+        });
+
+        req.pipe(proxyReq, { end: true });
+        return;
+      }
+
+      // All other requests -> Next.js
+      await handle(req, res, parsedUrl);
+    } catch (err) {
+      console.error("Error occurred handling", req.url, err);
+      res.writeHead(500);
+      res.end("internal server error");
+    }
+  }).listen(port, hostname, () => {
+    console.log(`> Ready on http://${hostname}:${port}`);
+    console.log(`> API proxy: ${backendUrl}`);
+  });
+});