fix: make frontend image self-contained for read-only filesystems (#128)

Revert Dockerfile to use /tmp redirect for envsubst output, so the image
works regardless of docker-compose.yml tmpfs configuration. Removes the
uid=101,gid=101 requirement from compose that was a breaking change.

docker-compose.yml

@@ -52,7 +52,7 @@ services:
       - /tmp:noexec,nosuid,size=64m
       - /var/cache/nginx:noexec,nosuid,size=64m
       - /var/run:noexec,nosuid,size=64m
-      - /etc/nginx/conf.d:noexec,nosuid,size=1m,uid=101,gid=101
+      - /etc/nginx/conf.d:noexec,nosuid,size=1m
     cap_drop:
       - ALL