build: ship pre-built API bundle; images copy output instead of installing

- API: `pnpm build` bundles dist/ into apps/api/.output (esbuild), with
  Linux musl native packages for sharp and argon2 kept alongside
- docker/api.Dockerfile copies that output; no pnpm install on the server
- add dist/migrate.js (prisma migrate deploy equivalent, same
  _prisma_migrations table and lock) so the Prisma CLI is not needed at runtime
- pnpm-workspace: supportedArchitectures for linux/x64/musl
- admin: apps/admin/.env.production sets VITE_SITE_URL for the production build
- drop NPM_REGISTRY / SITE_URL build args from compose and .env.example
- gitignore: anchor node_modules rules so pre-built node_modules are committed
- README: describe the pre-built deploy flow

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>

apps/api/.output/node_modules/@node-rs/argon2-linux-x64-musl/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@node-rs/argon2-linux-x64-musl",
+  "version": "2.2.2",
+  "cpu": [
+    "x64"
+  ],
+  "main": "argon2.linux-x64-musl.node",
+  "files": [
+    "argon2.linux-x64-musl.node"
+  ],
+  "description": "argon2-rust binding for Node.js",
+  "keywords": [
+    "argon2",
+    "argon2-password",
+    "crypto",
+    "encryption",
+    "hash",
+    "hashing",
+    "password",
+    "secure",
+    "verify"
+  ],
+  "homepage": "https://github.com/napi-rs/node-rs",
+  "license": "MIT",
+  "engines": {
+    "node": ">= 10"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/napi-rs/node-rs.git"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "os": [
+    "linux"
+  ],
+  "libc": [
+    "musl"
+  ]
+}