fix(docker): add Node.js frontend build stage and clean up deploy config

- Add Node 22/pnpm stage to mateclaw-server/Dockerfile so docker compose
  up -d --build produces a fully working image (the Vue SPA is now built
  inside the image and copied into the JAR's classpath/static).
- Remove DASHSCOPE_API_KEY from .env.example and root docker-compose.yml;
  LLM API keys are configured post-startup via the model management UI.

.env.example

@@ -1,18 +1,10 @@
 # MateClaw 环境变量配置
 # 复制此文件为 .env 并填写实际值：cp .env.example .env
 #
+# LLM API Key（DashScope、OpenAI 等）无需在此配置，启动后在管理界面「模型管理」中添加。
+#
 # ⚠️ 所有标注「必填」的项若没配置，`docker compose up` 会直接失败退出，避免把默认/示例值带到生产环境。
 
-# ==================== LLM / 搜索 ====================
-
-# 阿里云 DashScope API Key（必填）
-# 申请地址：https://dashscope.aliyun.com/
-DASHSCOPE_API_KEY=your-dashscope-api-key-here
-
-# Serper 网页搜索 API Key（可选，用于 WebSearch 工具）
-# 申请地址：https://serper.dev/
-SERPER_API_KEY=
-
 # ==================== 数据库（Docker 模式必填） ====================
 
 DB_HOST=localhost

docker-compose.yml

@@ -67,7 +67,7 @@ services:
       DB_NAME: ${DB_NAME:-mateclaw}
       DB_USERNAME: ${DB_USERNAME:-mateclaw}
       DB_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD is required in .env}
-      DASHSCOPE_API_KEY: ${DASHSCOPE_API_KEY:?DASHSCOPE_API_KEY is required in .env}
+      DASHSCOPE_API_KEY: ${DASHSCOPE_API_KEY:-}
       SERPER_API_KEY: ${SERPER_API_KEY:-}
       JWT_SECRET: ${JWT_SECRET:-}
       MATECLAW_CORS_ALLOWED_ORIGINS: ${MATECLAW_CORS_ALLOWED_ORIGINS:-}

mateclaw-server/Dockerfile

@@ -1,4 +1,24 @@
 # Multi-stage build
+#
+# Stage 1 — Frontend (Node / pnpm)
+#   Builds the Vue 3 admin SPA and emits static files to /static inside the
+#   build container. These files are later copied into the JAR's classpath so
+#   Spring Boot serves the SPA at the root URL.
+FROM node:22-alpine AS frontend-builder
+RUN npm install -g pnpm --silent
+WORKDIR /frontend
+# Install dependencies first (layer cache)
+COPY mateclaw-ui/package.json mateclaw-ui/pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+# Copy source and build
+COPY mateclaw-ui/ ./
+# Override outDir: vite.config.ts writes to ../mateclaw-server/…/static which
+# is outside this container; call vite directly to control --outDir.
+# Skipping vue-tsc here is intentional — type errors are caught in CI, not in
+# the production Docker image build.
+RUN pnpm exec vite build --outDir /static --emptyOutDir
+
+# Stage 2 — Backend (Maven)
 FROM maven:3.9-eclipse-temurin-21 AS builder
 
 # Inject mirror settings to avoid Maven Central timeouts in restricted networks
@@ -15,10 +35,13 @@ WORKDIR /build
 COPY mateclaw-server/pom.xml .
 RUN mvn dependency:go-offline -q
 
-# Build the final JAR
+# Copy backend source and inject pre-built frontend into the right classpath location
 COPY mateclaw-server/src ./src
+COPY --from=frontend-builder /static ./src/main/resources/static
+
 RUN mvn package -DskipTests -q
 
+# Stage 3 — Runtime
 FROM eclipse-temurin:21-jre-alpine
 WORKDIR /app
 COPY --from=builder /build/target/*.jar app.jar