feat(deploy): dockerize web app for portainer git-stack deploy behind external traefik

Add root Dockerfile (standalone Next output, multi-stage pnpm build), drop
in-stack caddy in favor of publishing web's port for an external traefik
LXC (file-provider dynamic config included), and document the portainer
deploy flow.

Also fixes issues that blocked any production build: a bad auth-client
type cast, the ai SDK's mimeType->mediaType rename, an implicit-any
callback param, and push.ts eagerly calling webpush.setVapidDetails at
module import time (which crashed page-data collection whenever VAPID
env vars weren't present at build) — now lazily configured on first send.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,43 @@
+# syntax=docker/dockerfile:1
+FROM node:22-alpine AS base
+RUN corepack enable
+
+# ---- deps: install full workspace deps ----
+FROM base AS deps
+WORKDIR /repo
+COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./
+COPY apps/web/package.json apps/web/package.json
+COPY packages/db/package.json packages/db/package.json
+COPY packages/api-types/package.json packages/api-types/package.json
+RUN pnpm install --frozen-lockfile
+
+# ---- build ----
+FROM base AS build
+WORKDIR /repo
+COPY --from=deps /repo/node_modules ./node_modules
+COPY --from=deps /repo/apps/web/node_modules ./apps/web/node_modules
+COPY --from=deps /repo/packages/db/node_modules ./packages/db/node_modules
+COPY --from=deps /repo/packages/api-types/node_modules ./packages/api-types/node_modules
+COPY . .
+# apps/web/.env.local is normally a symlink to repo-root .env.local (gitignored);
+# it doesn't exist in the build context, so Next's env loader chokes on the dangling
+# link. No secrets are needed at build time — they're injected at container runtime.
+RUN rm -f apps/web/.env.local && touch apps/web/.env.local
+ENV NEXT_TELEMETRY_DISABLED=1
+RUN pnpm --filter web build
+
+# ---- runtime ----
+FROM base AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=3000
+RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
+
+COPY --from=build /repo/apps/web/public ./public
+COPY --from=build --chown=nextjs:nodejs /repo/apps/web/.next/standalone ./
+COPY --from=build --chown=nextjs:nodejs /repo/apps/web/.next/static ./apps/web/.next/static
+
+USER nextjs
+EXPOSE 3000
+CMD ["node", "apps/web/server.js"]