fix: resolve assigned issues #1115, #1116, #1117, #1118

[codeX-james]

Summary

• [Infra] Frontend production image runs as root and bundles devDependencies #1115 – Frontend Dockerfile runs as root with devDependencies: Runner stage now installs production-only dependencies via npm ci --omit=dev, adds a non-root appuser, and includes a HEALTHCHECK directive matching the backend pattern.
• [Testing] LoanManager oracle interest-rate path is never exercised - the rate bounds-check has zero coverage #1116 – Oracle interest-rate path has zero test coverage: Added a MockRateOracle contract to the test module. New tests exercise the oracle branch: in-bounds rate is applied, below-min falls back to default, above-max falls back to default, get_rate_oracle returns the set address, and the RateOracleUpdated event is emitted.
• [Docs] ENVIRONMENT.md omits the RBAC role vars ADMIN_WALLETS / LENDER_WALLETS despite claiming to list every variable #1117 – ENVIRONMENT.md omits RBAC role vars: Documented ADMIN_WALLETS, LENDER_WALLETS, EXPOSE_STACK_TRACES, and JWT_COOKIE_NAME in docs/ENVIRONMENT.md with security notes. Added all four to backend/.env.example so the env-docs-check CI drift job enforces their presence.
• [Docs] webhooks.md signature-verification recipe is wrong - documents a t=,v1= header and timestamped payload, but the server emits sha256=<hex> over the raw body #1118 – webhooks.md signature recipe is wrong: Rewrote the "Verifying HMAC Signatures" section to match the actual sha256=<hex> header format over the raw body (no timestamp prefix). Corrected the secret source from a nonexistent WEBHOOK_SIGNING_SECRET env var to the per-subscription secret. Aligned docs/wiki/webhook-signatures.md Express example accordingly.

Closes #1115
Closes #1116
Closes #1117
Closes #1118

Test plan

• Verify frontend/Dockerfile builds successfully and the runner stage runs as appuser (non-root)
• Verify HEALTHCHECK passes when the frontend is running
• Run cargo test in contracts/loan_manager — new oracle tests should pass
• Verify env-docs-check CI passes with the new vars in both ENVIRONMENT.md and .env.example
• Confirm the webhook signature verification snippet in docs/webhooks.md matches docs/wiki/webhook-signatures.md and the actual server behavior in webhookService.ts