fix: address code-review findings (startup validation, shutdown hooks, health check, deploy config)

Verified each finding against the real codebase first, since the review's
diff was polluted by a stale leftover agent-worktree copy under
.claude/worktrees/ (now removed) that made several already-fixed or
never-broken issues look current (CORS, missing typecheck script, PWA
icons, font CSS, Helmet/Swagger CSP - all confirmed fine live, not
touched).

Real fixes:
- main.ts: fail-fast on missing DATABASE_URL/JWT_ACCESS_SECRET at boot,
  call enableShutdownHooks() so PrismaService.onModuleDestroy() actually
  runs on SIGTERM during k8s rolling deploys, PORT fallback 3000 -> 3001
  to match every other place that documents the port.
- health.controller.ts: log the real underlying DB error instead of
  discarding it, add a 5s timeout to the readiness query so a hung DB
  fails the probe fast instead of blocking indefinitely.
- Frontend Dockerfile: declare ARG/ENV NEXT_PUBLIC_API_URL before the
  build step, since Next.js inlines NEXT_PUBLIC_* vars at build time and
  a runtime-only ConfigMap value never reaches the compiled bundle.
- Backend ingress.yaml: drop the no-op rewrite-target regex for a plain
  prefix path (identical behavior, less confusing).

deploy/k8s/backend/ingress.yaml

@@ -3,7 +3,6 @@ kind: Ingress
 metadata:
   name: apicore-backend
   annotations:
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
     # Requires cert-manager with a ClusterIssuer named "letsencrypt-prod"
     # (or swap for whatever issuer/cert mechanism the cluster already uses).
     cert-manager.io/cluster-issuer: letsencrypt-prod
@@ -17,8 +16,8 @@ spec:
     - host: api.apicore.example.com
       http:
         paths:
-          - path: /()(.*)
-            pathType: ImplementationSpecific
+          - path: /
+            pathType: Prefix
             backend:
               service:
                 name: apicore-backend