fix(deploy): bake NEXT_PUBLIC_* vars in at build time, not runtime

NEXT_PUBLIC_VAPID_PUBLIC_KEY (and the OAuth *_ENABLED flags) are inlined
into the client bundle by next build — setting them as container env vars
at runtime does nothing, since the client JS was already built without
them. Client bundle shipped with applicationServerKey: undefined, so
pushManager.subscribe() threw and the button always failed with "Failed
to enable notifications."

Wire them as Docker build args (Dockerfile ARG/ENV before `next build`,
compose.prod.yml build.args), sourced from the same stack env vars used
at runtime so they stay in sync.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -30,6 +30,17 @@ COPY . .
 # link. No secrets are needed at build time — they're injected at container runtime.
 RUN rm -f apps/web/.env.local && touch apps/web/.env.local
 ENV NEXT_TELEMETRY_DISABLED=1
+# NEXT_PUBLIC_* vars are inlined into the client bundle at build time, not read at
+# container runtime — must be passed as build args (compose.prod.yml wires these
+# from the same stack env vars used at runtime, so they stay in sync).
+ARG NEXT_PUBLIC_VAPID_PUBLIC_KEY
+ARG NEXT_PUBLIC_GITHUB_ENABLED
+ARG NEXT_PUBLIC_DISCORD_ENABLED
+ARG NEXT_PUBLIC_AUTHENTIK_ENABLED
+ENV NEXT_PUBLIC_VAPID_PUBLIC_KEY=$NEXT_PUBLIC_VAPID_PUBLIC_KEY
+ENV NEXT_PUBLIC_GITHUB_ENABLED=$NEXT_PUBLIC_GITHUB_ENABLED
+ENV NEXT_PUBLIC_DISCORD_ENABLED=$NEXT_PUBLIC_DISCORD_ENABLED
+ENV NEXT_PUBLIC_AUTHENTIK_ENABLED=$NEXT_PUBLIC_AUTHENTIK_ENABLED
 RUN pnpm --filter web build
 
 # ---- runtime ----