Containerise for Dokploy, and a demo login that survives production

Everything needed to build and run this on Dokploy at
linkdr.serfaty.site, plus the two things that turned out to be broken
the moment it left a laptop.

The build did not work in a container at all. `lib/auth.ts` throws when
AUTH_SECRET or NEXT_PUBLIC_APP_URL is missing — correct at boot, wrong
during `next build`, which imports every route module with
NODE_ENV=production and none of the runtime secrets. The only way past
it was baking a session key into an image layer, which is worse than
the problem the guard exists to prevent. Both checks now skip
NEXT_PHASE=phase-production-build and still fire on a real boot.

Corepack in node:22.12-alpine ships expired npm registry signing keys
and dies before it can download pnpm, so the image installs corepack
first and prepares the pinned version explicitly.

The image is the standalone trace, which needs outputFileTracingRoot at
the REPO root: pnpm hoists to a root .pnpm store and tracing from
apps/web silently omits every workspace package. 427MB, runs as
non-root, and its healthcheck talks to Postgres — a container that
cannot reach its database must never enter rotation, because a deploy
that goes green and then 500s does not roll back.

DEMO_LOGIN is a login bypass under NODE_ENV=production and there is no
honest way to describe it otherwise. It is a separate variable from
ALLOW_DEV_LOGIN so that copying a dev .env into a real environment
cannot enable it by accident, it still only affects the one seeded
number, and it prints a boot warning every single start so it cannot be
forgotten. That deployment holds nothing but fixtures. It comes out
before the platform sees a real signup.

Also: /api/health, and next/image hosts corrected to the Spaces bucket
rather than the R2 one this stopped using.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,54 @@
+# The build stage does `COPY . .`, so anything not excluded here ends up in an
+# image layer — and a layer is readable by anyone who can pull the image, even
+# if a later stage deletes the file.
+
+# ---- Secrets. Non-negotiable. ----
+# The platform injects the environment; a baked .env would ship live database
+# and Spaces credentials inside the image.
+.env
+.env.*
+!.env.example
+
+# ---- Build inputs that must be produced inside the image ----
+# A host node_modules is the wrong platform (linux/musl vs win32/darwin) and
+# would silently shadow the one `pnpm install` builds in the deps stage.
+node_modules
+**/node_modules
+.next
+**/.next
+.turbo
+**/.turbo
+dist
+**/dist
+out
+**/out
+
+# ---- Never needed at runtime ----
+.git
+.gitignore
+.github
+.vscode
+.idea
+**/test
+**/tests
+**/*.test.ts
+**/*.test.tsx
+**/vitest.config.ts
+playwright-report
+test-results
+coverage
+**/*.log
+.DS_Store
+Thumbs.db
+
+# Docs and local tooling. Keeping them out is about layer size and churn: a
+# README edit should not invalidate the build cache.
+*.md
+!README.md
+docker-compose.yml
+docker-compose.*.yml
+Dockerfile
+.dockerignore
+
+# NOTE: ca-certificate.crt is deliberately NOT ignored. DATABASE_CA_CERT may
+# point at it, and it is a public certificate — no private key. See db/client.ts.