fix(docker): prefix compose image names with localhost to prevent Docker Hub lookups

randall/frontend and randall/backend were being resolved as docker.io
paths, causing unwanted registry auth attempts. The localhost/ prefix
marks them as local-only images. Also restores docker/setup-buildx-action
with the docker driver, and reverts the ECR Public mirror workaround
since it was never the root cause.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -51,6 +51,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+
       - name: Build images
         run: docker compose -f cicd/docker/docker-compose.yml build
 

cicd/docker/Dockerfile.frontend

@@ -1,5 +1,5 @@
 # Build stage
-FROM public.ecr.aws/docker/library/node:22-alpine AS build
+FROM node:22-alpine AS build
 WORKDIR /app
 
 # Install dependencies — copy lockfiles first to cache the npm layer
@@ -18,7 +18,7 @@ COPY src/frontend/public/ ./public/
 RUN npm run build
 
 # Serve stage
-FROM public.ecr.aws/docker/library/nginx:alpine AS runtime
+FROM nginx:alpine AS runtime
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY cicd/docker/nginx.conf /etc/nginx/conf.d/default.conf
 

cicd/docker/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   backend:
-    image: randall/backend:latest
+    image: localhost/randall/backend:latest
     build:
       context: ../..
       dockerfile: cicd/docker/Dockerfile.backend
@@ -21,7 +21,7 @@ services:
       start_period: 10s
 
   frontend:
-    image: randall/frontend:latest
+    image: localhost/randall/frontend:latest
     build:
       context: ../..
       dockerfile: cicd/docker/Dockerfile.frontend