build(portal-frontend): add Dockerfile and SPA nginx config

Multi-stage: node build with --base-href=/portal/, then nginx:alpine
serving the compiled dist with try_files SPA fallback for client-side
routes (e.g. a direct hit on /legacy/1001). Verified standalone: root
and a deep link both 200, base href correct.

portal-frontend/nginx.conf

@@ -0,0 +1,8 @@
+server {
+  listen 80;
+  root /usr/share/nginx/html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+}