feat: add Dockerfile + app service for production deploy

Adds a production Docker image (node:20-alpine) and an `app` service in
docker-compose.yml so the Next.js app can run as a long-lived container
instead of just build/test in ephemeral containers. Requires `apk add
openssl` before `npm ci`, otherwise Prisma silently picks the wrong query
engine binary on Alpine and only fails at runtime. Also wires
AUTH_TRUST_HOST=true, required by Auth.js when running behind the NPM
reverse proxy.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

Dockerfile

@@ -0,0 +1,19 @@
+FROM node:20-alpine
+WORKDIR /app
+
+# Prisma's engine detection needs libssl present at `npm ci` time (when
+# `postinstall` runs `prisma generate`) — without it, Prisma can't detect
+# the OpenSSL version and silently picks the wrong engine binary, which
+# only fails later at runtime when a query actually tries to run.
+RUN apk add --no-cache openssl
+
+COPY package.json package-lock.json ./
+COPY prisma ./prisma
+RUN npm ci
+
+COPY . .
+RUN npm run build
+
+ENV NODE_ENV=production
+EXPOSE 3000
+CMD ["npm", "start"]