frontend: gate the Docker build on make check (closes #11)

The frontend Dockerfile ran only yarn build, so the container build
failed only on a broken build, not on lint or fmt-check regressions --
while script/cibuild's comment already assumed the Dockerfile ran make
check. Install make in the build stage and run make check (test + lint
+ fmt-check) in place of the bare yarn build. Its test step is the
production yarn build, so dist/ is still produced in a single build with
no redundant rebuild, and CI now goes red on any check failure.

Dockerfile

@@ -3,9 +3,12 @@ FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e3
 WORKDIR /app
 COPY package.json yarn.lock ./
 RUN yarn install --frozen-lockfile
-RUN apk add --no-cache git
+RUN apk add --no-cache git make
 COPY . .
-RUN yarn build
+# make check runs script/check (test + lint + fmt-check); its test step
+# is the production yarn build, so this both produces dist/ and gates the
+# image on lint/fmt-check/test regressions, not merely a broken build.
+RUN make check
 
 # nginx:stable-alpine as of 2026-02-22
 FROM nginx@sha256:15e96e59aa3b0aada3a121296e3bce117721f42d88f5f64217ef4b18f458c6ab