fix(frontend): patch undici alerts and harden staging web

Makefile

@@ -12,6 +12,7 @@ DEV_SCANNER_URL := http://localhost:8000
 STAGING_API_URL := http://localhost:8080
 STAGING_WEB_URL := http://localhost
 STAGING_SERVER_IMAGE := skillhub-server:staging
+STAGING_WEB_IMAGE := skillhub-web:staging
 DEV_PROCESS := bash scripts/dev-process.sh
 DEV_SERVER_PREPARE := true
 DEV_SERVER_CMD := ./scripts/run-dev-app.sh
@@ -296,12 +297,13 @@ db-reset: ## 重置数据库
 validate-release-config: ## 校验发布环境变量文件（默认 .env.release）
 	./scripts/validate-release-config.sh .env.release
 
-staging: ## 构建并启动 staging 环境，运行 smoke test（混合模式：后端镜像 + 前端静态文件）
+staging: ## 构建并启动 staging 环境，运行 smoke test（后端/前端均走本地构建镜像）
 	@echo "=== [1/5] Building backend JAR and Docker image ==="
 	cd server && ./mvnw package -DskipTests -B -q
 	docker build -t $(STAGING_SERVER_IMAGE) -f server/Dockerfile.dev server
-	@echo "=== [2/5] Building frontend static files ==="
+	@echo "=== [2/5] Building frontend static files and Docker image ==="
 	cd web && pnpm run build
+	docker build -t $(STAGING_WEB_IMAGE) -f web/Dockerfile web
 	@echo "=== [3/5] Starting dependency services ==="
 	$(STAGING_BASE_COMPOSE) up -d --wait
 	@echo "=== [4/5] Starting staging services ==="

docker-compose.staging.yml

@@ -1,6 +1,6 @@
-# Staging environment: hybrid mode
+# Staging environment
 # - Backend: locally built Docker image
-# - Frontend: locally built static files mounted into Nginx
+# - Frontend: locally built Docker image
 # - Dependencies: reuses docker-compose.yml (postgres, redis, minio)
 #
 # Usage: make staging
@@ -61,12 +61,9 @@ services:
       start_period: 60s
 
   web:
-    image: nginx:alpine
+    image: skillhub-web:staging
     ports:
       - "80:80"
-    volumes:
-      - ./web/dist:/usr/share/nginx/html:ro
-      - ./web/nginx.conf.template:/etc/nginx/templates/default.conf.template:ro
     environment:
       SKILLHUB_API_UPSTREAM: http://server:8080
       SKILLHUB_WEB_API_BASE_URL: ""

web/package.json

@@ -12,6 +12,7 @@
       "vite@<6.4.3": "^6.4.3",
       "esbuild@<0.28.1": "^0.28.1",
       "js-yaml@<4.2.0": "^4.2.0",
+      "undici@<7.28.0": "^7.28.0",
       "@babel/core@<7.29.6": "^7.29.6",
       "postcss@<8.5.10": "^8.5.10",
       "picomatch@<2.3.2": "^2.3.2",

web/pnpm-lock.yaml

@@ -8,6 +8,7 @@ overrides:
   vite@<6.4.3: ^6.4.3
   esbuild@<0.28.1: ^0.28.1
   js-yaml@<4.2.0: ^4.2.0
+  undici@<7.28.0: ^7.28.0
   '@babel/core@<7.29.6': ^7.29.6
   postcss@<8.5.10: ^8.5.10
   picomatch@<2.3.2: ^2.3.2
@@ -2685,8 +2686,8 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
-  undici@7.25.0:
-    resolution: {integrity: sha512-xXnp4kTyor2Zq+J1FfPI6Eq3ew5h6Vl0F/8d9XU5zZQf1tX9s2Su1/3PiMmUANFULpmksxkClamIZcaUqryHsQ==}
+  undici@7.28.0:
+    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
     engines: {node: '>=20.18.1'}
 
   unified@11.0.5:
@@ -3810,7 +3811,7 @@ snapshots:
 
   '@testing-library/dom@10.4.1':
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       '@babel/runtime': 7.28.6
       '@types/aria-query': 5.0.4
       aria-query: 5.3.0
@@ -4662,7 +4663,7 @@ snapshots:
       saxes: 6.0.0
       symbol-tree: 3.2.4
       tough-cookie: 6.0.1
-      undici: 7.25.0
+      undici: 7.28.0
       w3c-xmlserializer: 5.0.0
       webidl-conversions: 8.0.1
       whatwg-mimetype: 5.0.0
@@ -5680,7 +5681,7 @@ snapshots:
 
   typescript@5.9.3: {}
 
-  undici@7.25.0: {}
+  undici@7.28.0: {}
 
   unified@11.0.5:
     dependencies: