chore(docker): build contacts-web locally instead of using GHCR image

GHCR image was outdated (2026-01-29), missing:
- Demo mode removal (2026-01-30)
- SSO implementation (2026-02-02)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker-compose.macmini.yml

@@ -203,6 +203,46 @@ services:
       retries: 3
       start_period: 40s
 
+  mana-media:
+    build:
+      context: .
+      dockerfile: services/mana-media/apps/api/Dockerfile
+    image: mana-media:local
+    container_name: mana-core-media
+    restart: always
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      minio:
+        condition: service_healthy
+    environment:
+      NODE_ENV: production
+      PORT: 3015
+      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD:-mana123}@postgres:5432/mana_media
+      REDIS_HOST: redis
+      REDIS_PORT: 6379
+      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis123}
+      S3_ENDPOINT: minio
+      S3_PORT: 9000
+      S3_USE_SSL: "false"
+      S3_ACCESS_KEY: ${MINIO_ACCESS_KEY:-minioadmin}
+      S3_SECRET_KEY: ${MINIO_SECRET_KEY:-minioadmin}
+      S3_BUCKET: mana-media
+      S3_PUBLIC_URL: https://media.mana.how
+      MATRIX_HOMESERVER_URL: https://matrix.mana.how
+      PUBLIC_URL: https://media.mana.how/api/v1
+      CORS_ORIGINS: https://mana.how,https://nutriphi.mana.how,https://contacts.mana.how,https://chat.mana.how,https://storage.mana.how
+    ports:
+      - "3015:3015"
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3015/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
   # ============================================
   # Tier 3: App Backends (Ports 3030-3049)
   # ============================================
@@ -940,7 +980,13 @@ services:
       start_period: 40s
 
   contacts-web:
-    image: ghcr.io/memo-2023/contacts-web:latest
+    build:
+      context: .
+      dockerfile: apps/contacts/apps/web/Dockerfile
+      args:
+        PUBLIC_BACKEND_URL: http://contacts-backend:3034
+        PUBLIC_MANA_CORE_AUTH_URL: http://mana-auth:3001
+    image: contacts-web:local
     container_name: mana-app-contacts-web
     restart: always
     depends_on: