feat(deploy): add Docker build + Traefik-based production deployment

- Dockerfile: multi-stage pnpm monorepo build with Next.js standalone output
- .dockerignore: exclude node_modules, .next, .env, dev artifacts
- next.config.ts: enable `output: standalone` for slim runtime image
- compose.prod.yml: replace Caddy with Traefik labels, add migrate init
  service, split internal/external networks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,42 @@
+FROM node:22-alpine AS base
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
+# ---- fetch deps (lockfile only) ----
+FROM base AS deps
+WORKDIR /app
+COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
+COPY apps/web/package.json ./apps/web/
+COPY packages/db/package.json ./packages/db/
+COPY packages/api-types/package.json ./packages/api-types/
+RUN pnpm fetch
+
+# ---- build ----
+FROM deps AS builder
+WORKDIR /app
+COPY . .
+RUN pnpm install --offline --frozen-lockfile
+ENV NEXT_TELEMETRY_DISABLED=1
+RUN pnpm build
+
+# ---- runtime ----
+FROM node:22-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN addgroup --system --gid 1001 nodejs \
+ && adduser --system --uid 1001 nextjs
+
+# standalone output mirrors monorepo path structure
+COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public
+
+USER nextjs
+EXPOSE 3000
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+
+CMD ["node", "apps/web/server.js"]