fix: resolve four production correctness issues

[23f3001369]

1. app.ts: fix frontendDistPath (was resolving to /app/frontend/dist which doesn't exist; correct path is ../../apps/frontend/dist matching the Dockerfile runtime stage COPY layout)

2. zoomOAuth.ts: fail fast in production if ZOOM_REDIRECT_URI is unset (previously defaulted to localhost silently, breaking OAuth callbacks)

3. .env.example: JWT_EXPIRES_IN now documents 15m (matching the actual auth.controller.ts default of 15m, not 7d which was a security risk)

4. docker-compose.prod.yml: add nginx/frontend service (was missing; backend only served the SPA in containers — now frontend is a proper separate service on port 80). Also add JWT_SECRET to backend env vars for defensive startup when .env is pre-populated.

What changed

Related issue

Type of change

• Bug fix
• Feature
• Refactor (no behaviour change)
• Docs / comments only
• CI / tooling

Area affected

• Backend (Express / Mongoose)
• Frontend (React / Vite)
• Pipeline (auto-answer / FAQ audit / Zoom ingestion)
• Search (hybrid vector + keyword)
• Auth / middleware
• Docs

Checklist

• cd backend && npx tsc --noEmit — clean
• cd frontend && npx tsc --noEmit — clean
• Tests pass (npm test in affected package)
• Single logical change — unrelated fixes noted in description, not fixed here
• Docs updated if route / API / env var / pipeline behaviour changed
• Rebased onto main, no merge commits

Notes for reviewer