fix: resolve all Docker build errors

- pnpm: remove separate deps stage (cross-stage copy breaks virtual store links)
- Add .dockerignore (node_modules, .next, secrets)
- map-client.tsx: escape apostrophe, use Link instead of <a>
- cron/review-digest/route.ts: unexport signUserId (invalid Next.js route export)
- auth.ts: guard user.id undefined before eq() call
- queries.ts: fix swapped lte(Date, column) → gte(column, Date) (×2)
- Dockerfile: drop COPY public/ (directory doesn't exist)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,5 @@
+.next
+node_modules
+.env.local
+.env.prod
+.git

Dockerfile

@@ -1,20 +1,16 @@
 FROM node:22-alpine AS base
 RUN corepack enable && corepack prepare pnpm@latest --activate
 
-# ── deps ─────────────────────────────────────────────────────────────────────
-FROM base AS deps
-WORKDIR /app
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN pnpm install --frozen-lockfile
-
 # ── builder ───────────────────────────────────────────────────────────────────
 FROM base AS builder
 WORKDIR /app
-COPY --from=deps /app/node_modules ./node_modules
+# Install deps first (cached until lockfile changes)
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN pnpm install --frozen-lockfile
+# Copy source and build
 COPY . .
-# Dummy env so Next.js build doesn't fail on missing vars at build time.
-# Real values are injected at runtime via docker-compose env.
 ENV NEXT_TELEMETRY_DISABLED=1
+# Dummy build-time vars — real values injected at runtime via docker-compose.
 ENV DATABASE_URL=postgresql://placeholder:placeholder@localhost:5432/curio
 ENV REDIS_URL=redis://localhost:6379
 ENV AUTH_SECRET=build-placeholder
@@ -29,7 +25,6 @@ ENV NEXT_TELEMETRY_DISABLED=1
 RUN addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs
 
-COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 
@@ -41,7 +36,8 @@ CMD ["node", "server.js"]
 # ── worker (BullMQ — needs full source + tsx) ─────────────────────────────────
 FROM base AS worker
 WORKDIR /app
-COPY --from=deps /app/node_modules ./node_modules
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+RUN pnpm install --frozen-lockfile
 COPY . .
 ENV NODE_ENV=production
 CMD ["node_modules/.bin/tsx", "jobs/bootstrap.ts"]

src/app/api/cron/review-digest/route.ts

@@ -9,7 +9,7 @@ import { sendEmail } from '@/lib/email';
 
 const BASE_URL = process.env.AUTH_URL ?? 'http://localhost:3000';
 
-export function signUserId(userId: string): string {
+function signUserId(userId: string): string {
   const secret = process.env.UNSUBSCRIBE_SECRET ?? 'dev-secret-change-in-prod';
   return createHmac('sha256', secret).update(userId).digest('hex');
 }

src/app/map/map-client.tsx

@@ -305,9 +305,9 @@ export function ThemeMapClient() {
         <ThemeGraph themes={themes} locale={locale} onExplore={handleExplore} />
       ) : listThemes.length === 0 ? (
         <div className="theme-map-empty">
-          <p>Aucun thème exploré pour l'instant.</p>
+          <p>Aucun thème exploré pour l&apos;instant.</p>
           <p>
-            <a href="/" className="theme-map-empty-link">Commencer à apprendre →</a>
+            <Link href="/" className="theme-map-empty-link">Commencer à apprendre →</Link>
           </p>
         </div>
       ) : (

src/auth.ts

@@ -75,7 +75,7 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
     async createUser({ user }) {
       // First ever user becomes admin — covers OAuth sign-up path
       const [{ total }] = await db.select({ total: count() }).from(users);
-      if (total === 1) {
+      if (total === 1 && user.id) {
         await db.update(users).set({ role: 'admin' }).where(eq(users.id, user.id));
       }
     },

src/lib/db/queries.ts

@@ -1,4 +1,4 @@
-import { eq, asc, lte, and, inArray, lt, desc, not, isNull, sql, count, countDistinct } from 'drizzle-orm';
+import { eq, asc, lte, gte, and, inArray, lt, desc, not, isNull, sql, count, countDistinct } from 'drizzle-orm';
 import { db } from './index';
 import {
   blueprints,
@@ -1049,7 +1049,7 @@ export async function getOnlineGradeMetrics(windowDays = 30): Promise<OnlineGrad
     .select({ verdict: grades.verdict, createdAt: responses.ts })
     .from(grades)
     .innerJoin(responses, eq(grades.responseId, responses.id))
-    .where(lte(since, responses.ts));
+    .where(gte(responses.ts, since));
 
   const totalGrades = gradeRows.length;
   const byVerdict: Record<string, number> = {};
@@ -1060,7 +1060,7 @@ export async function getOnlineGradeMetrics(windowDays = 30): Promise<OnlineGrad
   const disputeRows = await db
     .select({ id: contentReports.id })
     .from(contentReports)
-    .where(and(eq(contentReports.reason, 'grade_wrong'), lte(since, contentReports.createdAt)));
+    .where(and(eq(contentReports.reason, 'grade_wrong'), gte(contentReports.createdAt, since)));
   const gradeWrongReports = disputeRows.length;
 
   const flaggedRows = await db