chore(staging): keep dependabot fix scoped

Signed-off-by: dongmucat <1127093059@qq.com>

Makefile

@@ -12,7 +12,6 @@ DEV_SCANNER_URL := http://localhost:8000
 STAGING_API_URL := http://localhost:8080
 STAGING_WEB_URL := http://localhost
 STAGING_SERVER_IMAGE := skillhub-server:staging
-STAGING_WEB_IMAGE := skillhub-web:staging
 DEV_PROCESS := bash scripts/dev-process.sh
 DEV_SERVER_PREPARE := true
 DEV_SERVER_CMD := ./scripts/run-dev-app.sh
@@ -297,13 +296,12 @@ db-reset: ## 重置数据库
 validate-release-config: ## 校验发布环境变量文件（默认 .env.release）
 	./scripts/validate-release-config.sh .env.release
 
-staging: ## 构建并启动 staging 环境，运行 smoke test（后端/前端均走本地构建镜像）
+staging: ## 构建并启动 staging 环境，运行 smoke test（混合模式：后端镜像 + 前端静态文件）
 	@echo "=== [1/5] Building backend JAR and Docker image ==="
 	cd server && ./mvnw package -DskipTests -B -q
 	docker build -t $(STAGING_SERVER_IMAGE) -f server/Dockerfile.dev server
-	@echo "=== [2/5] Building frontend static files and Docker image ==="
+	@echo "=== [2/5] Building frontend static files ==="
 	cd web && pnpm run build
-	docker build -t $(STAGING_WEB_IMAGE) -f web/Dockerfile web
 	@echo "=== [3/5] Starting dependency services ==="
 	$(STAGING_BASE_COMPOSE) up -d --wait
 	@echo "=== [4/5] Starting staging services ==="

docker-compose.staging.yml

@@ -1,6 +1,6 @@
-# Staging environment
+# Staging environment: hybrid mode
 # - Backend: locally built Docker image
-# - Frontend: locally built Docker image
+# - Frontend: locally built static files mounted into Nginx
 # - Dependencies: reuses docker-compose.yml (postgres, redis, minio)
 #
 # Usage: make staging
@@ -61,9 +61,12 @@ services:
       start_period: 60s
 
   web:
-    image: skillhub-web:staging
+    image: nginx:alpine
     ports:
       - "80:80"
+    volumes:
+      - ./web/dist:/usr/share/nginx/html:ro
+      - ./web/nginx.conf.template:/etc/nginx/templates/default.conf.template:ro
     environment:
       SKILLHUB_API_UPSTREAM: http://server:8080
       SKILLHUB_WEB_API_BASE_URL: ""