ruby: Gemfile.lock is not enforced at image build time

Noted by @mchipouras while reviewing #46 (pre-existing, not introduced there): `ruby/docker-compose/services/*/Dockerfile` runs `COPY Gemfile ./` followed by plain `bundle install`, so `Gemfile.lock` never enters the image and resolved versions can drift from the checked-in lockfile on every build.

Suggested fix: `COPY Gemfile Gemfile.lock ./` and enforce with `ENV BUNDLE_FROZEN=1` (or `bundle config set frozen true`) in the build stage. Applies to all three service Dockerfiles; the k8s variant builds from the same sources.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Inspect ruby/docker-compose/services/*/Dockerfile, focusing on the existing Gemfile copy and bundle install steps across all three service Dockerfiles. Update the build stage so Gemfile.lock is copied and Bundler runs in frozen mode; done means image builds use the checked-in lockfile consistently, including the Kubernetes variant that uses the same sources.

Written by the indexing model from the issue text.