fix(docker): pull node and nginx from ECR Public mirror

GitHub Actions runner IP is banned from Docker Hub. Using
public.ecr.aws/docker/library as a temporary workaround.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cicd/docker/Dockerfile.frontend

@@ -1,5 +1,5 @@
 # Build stage
-FROM node:22-alpine AS build
+FROM public.ecr.aws/docker/library/node:22-alpine AS build
 WORKDIR /app
 
 # Install dependencies — copy lockfiles first to cache the npm layer
@@ -18,7 +18,7 @@ COPY src/frontend/public/ ./public/
 RUN npm run build
 
 # Serve stage
-FROM nginx:alpine AS runtime
+FROM public.ecr.aws/docker/library/nginx:alpine AS runtime
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY cicd/docker/nginx.conf /etc/nginx/conf.d/default.conf