Complete docker build in preparation for app-runner deployment

Dockerfile

@@ -0,0 +1,53 @@
+# --- Build stage ---
+FROM node:24-slim AS build
+WORKDIR /app
+
+# Placeholder values ONLY so `vite build` doesn't crash on $env/static/*
+# imports during the build step. These are NOT the real runtime values —
+# App Platform injects the real ones as env vars when the container runs.
+ARG DATABASE_URL=postgres://placeholder:placeholder@localhost:5432/placeholder
+ARG ORIGIN=http://localhost:3000
+ARG BETTER_AUTH_URL=http://localhost:3000
+ARG BETTER_AUTH_BASE_URL=http://localhost:3000
+ARG BETTER_AUTH_SECRET=placeholder-build-time-secret-not-used-at-runtime
+ENV DATABASE_URL=$DATABASE_URL
+ENV ORIGIN=$ORIGIN
+ENV BETTER_AUTH_URL=$BETTER_AUTH_URL
+ENV BETTER_AUTH_BASE_URL=$BETTER_AUTH_BASE_URL
+ENV BETTER_AUTH_SECRET=$BETTER_AUTH_SECRET
+
+COPY package*.json ./
+RUN npm ci
+
+COPY . .
+RUN npm run build
+
+# Drop devDependencies now that the build is done
+RUN npm prune --omit=dev
+
+# --- Runtime stage ---
+FROM node:24-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=3000
+
+# Install the DigitalOcean managed DB CA cert into the system trust store.
+# `ca-certificates` provides update-ca-certificates; certs placed in
+# /usr/local/share/ca-certificates/ must end in .crt to be picked up.
+COPY digital-ocean.crt /usr/local/share/ca-certificates/digital-ocean.crt
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates \
+    && update-ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Node still doesn't read the system trust store unless --use-system-ca is
+# passed explicitly (available on 22.19+/24.6+, but off by default even here).
+# NODE_EXTRA_CA_CERTS is simpler and works regardless of Node version.
+ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/digital-ocean.crt
+
+COPY --from=build /app/build ./build
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/package.json ./package.json
+
+EXPOSE 3000
+CMD ["node", "build/index.js"]