feat(deploy): dockerize web app for portainer git-stack deploy behind external traefik

Add root Dockerfile (standalone Next output, multi-stage pnpm build), drop
in-stack caddy in favor of publishing web's port for an external traefik
LXC (file-provider dynamic config included), and document the portainer
deploy flow.

Also fixes issues that blocked any production build: a bad auth-client
type cast, the ai SDK's mimeType->mediaType rename, an implicit-any
callback param, and push.ts eagerly calling webpush.setVapidDetails at
module import time (which crashed page-data collection whenever VAPID
env vars weren't present at build) — now lazily configured on first send.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker/traefik/epicure.yml

@@ -0,0 +1,24 @@
+# Traefik file-provider dynamic config.
+# Copy to traefik LXC's dynamic config dir (the one referenced by
+# providers.file.directory in traefik's static config), then edit
+# HOST_DOMAIN and PORTAINER_LXC_IP below.
+
+http:
+  routers:
+    epicure:
+      rule: "Host(`HOST_DOMAIN`)"
+      entryPoints:
+        - websecure
+      service: epicure
+      tls:
+        certResolver: letsencrypt # match whatever resolver name is set in your traefik static config
+
+  services:
+    epicure:
+      loadBalancer:
+        servers:
+          - url: "http://PORTAINER_LXC_IP:3000" # match WEB_PORT from docker/compose.prod.yml env
+        healthCheck:
+          path: /
+          interval: 10s
+          timeout: 3s