Bake PUBLIC_URL into the frontend bundle at build time

Next.js inlines NEXT_PUBLIC_* env vars into the client JS bundle at
`npm run build` time; they're not read at runtime. The frontend
Dockerfile wasn't accepting that value as a build arg, so the
client bundle was always built with the source-default fallback of
http://localhost:3001 and the browser tried to hit localhost for
every API call (visible in DevTools as ERR_CONNECTION_REFUSED on
/me, /me/onboarding-options, /user/profile, etc.).

Add an ARG NEXT_PUBLIC_API_BASE_URL to the frontend build stage and
wire docker-compose.yml to pass ${PUBLIC_URL} into it. The runtime
env block already mirrors the same value for server-side fetches.

After this lands, `update.sh` rebuilds the frontend image with the
right URL baked in.