perf(docker): бандл API, brotli-статика, wget-healthcheck, лимиты ресурсов, вендорные чанки web

deploy/docker-compose.traefik.yml

@@ -56,6 +56,18 @@ services:
     restart: unless-stopped
     init: true
     stop_grace_period: 15s
+    # Лимиты ресурсов: heap Node (NODE_OPTIONS в образе) рассчитан на 256 МиБ.
+    mem_limit: 256m
+    memswap_limit: 256m
+    cpus: "1.0"
+    pids_limit: 128
+    read_only: true
+    tmpfs:
+      - /tmp
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
     depends_on:
       - traefik
     # No host ports — only Traefik publishes 80/443.
@@ -93,13 +105,7 @@ services:
       - traefik.http.middlewares.auth-portal-compress.compress=true
       - traefik.http.routers.auth-portal.middlewares=auth-portal-compress
     healthcheck:
-      test:
-        [
-          "CMD",
-          "node",
-          "-e",
-          "fetch('http://127.0.0.1:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
-        ]
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/health"]
       interval: 30s
       timeout: 5s
       retries: 3