feat(infra): configure next.js image proxy to hide backend url

- Implemented /_img/ rewrite in next.config.mjs to proxy requests to IMGPROXY_URL
- Updated lib/imgproxy.ts to use local /_img path instead of public endpoint
- Replaced NEXT_PUBLIC_IMGPROXY_URL (build-time) with IMGPROXY_URL (runtime) env var
- Updated docker-compose.yml to strip build args and inject runtime IMGPROXY_URL
- Cleaned up Dockerfile and audit scripts

docker-compose.yml

@@ -15,6 +15,8 @@ services:
           - klz.localhost
     env_file:
       - ${ENV_FILE:-.env}
+    environment:
+      IMGPROXY_URL: ${IMGPROXY_URL:-http://klz-imgproxy:8080}
     labels:
       - "traefik.enable=true"
       # HTTP ⇒ HTTPS redirect
@@ -115,10 +117,7 @@ services:
       DB_PASSWORD: ${DIRECTUS_DB_PASSWORD:-120in09oenaoinsd9iaidon}
       WEBSOCKETS_ENABLED: 'true'
       PUBLIC_URL: ${DIRECTUS_URL:-https://cms.klz-cables.com}
-      WEBSOCKETS_ENABLED: 'true'
-      PUBLIC_URL: ${DIRECTUS_URL:-https://cms.klz-cables.com}
       HOST: '0.0.0.0'
-      IMGPROXY_URL: ${IMGPROXY_URL:-http://klz-imgproxy:8080}
     networks:
       - default
       - infra