build: ship pre-built API bundle; images copy output instead of installing

- API: `pnpm build` bundles dist/ into apps/api/.output (esbuild), with
  Linux musl native packages for sharp and argon2 kept alongside
- docker/api.Dockerfile copies that output; no pnpm install on the server
- add dist/migrate.js (prisma migrate deploy equivalent, same
  _prisma_migrations table and lock) so the Prisma CLI is not needed at runtime
- pnpm-workspace: supportedArchitectures for linux/x64/musl
- admin: apps/admin/.env.production sets VITE_SITE_URL for the production build
- drop NPM_REGISTRY / SITE_URL build args from compose and .env.example
- gitignore: anchor node_modules rules so pre-built node_modules are committed
- README: describe the pre-built deploy flow

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>

docker/api.Dockerfile

@@ -1,40 +1,21 @@
-# NestJS API. Build context: repository root.
+# NestJS API. Pre-built output: `pnpm build` bundles it into apps/api/.output (apps/api/scripts/bundle.mjs).
 #   docker build -f docker/api.Dockerfile -t imen-api .                    # API server
 #   docker build -f docker/api.Dockerfile --target migrate -t imen-migrate . # one-off migrations
 ARG NODE_IMAGE=docker.arvancloud.ir/node:24-alpine
 
-FROM ${NODE_IMAGE} AS build
-# npm registry (and mirror for corepack's pnpm download) — override where npmjs.org is slow or blocked
-ARG NPM_REGISTRY=https://registry.npmjs.org/
-ENV COREPACK_NPM_REGISTRY=${NPM_REGISTRY} npm_config_registry=${NPM_REGISTRY}
-RUN corepack enable
-WORKDIR /repo
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-COPY packages/shared packages/shared
-COPY apps/api apps/api
-RUN pnpm config set fetch-retries 5 \
- && pnpm config set fetch-retry-maxtimeout 120000 \
- && pnpm install --frozen-lockfile --filter "@imen/api..." || pnpm install --no-frozen-lockfile --filter "@imen/api..."
-RUN pnpm --filter "@imen/api..." build
-# self-contained production node_modules (workspace packages copied, dev deps dropped).
-# @prisma/client lists the Prisma CLI and TypeScript as optional peers, so pnpm keeps them
-# (plus Prisma Studio's React/PGlite/effect) — none are used at runtime, drop ~300 MB.
-RUN pnpm --filter @imen/api deploy --prod --legacy /out \
- && cd /out/node_modules/.pnpm \
- && rm -rf prisma@* @prisma+studio-core@* @prisma+dev@* @electric-sql+* effect@* typescript@* react@* react-dom@*
-
-# applies pending migrations and exits (needs the Prisma CLI, a dev dependency)
-FROM build AS migrate
-WORKDIR /repo/apps/api
-CMD ["node_modules/.bin/prisma", "migrate", "deploy"]
-
-FROM ${NODE_IMAGE} AS runtime
+FROM ${NODE_IMAGE} AS app
 WORKDIR /app
-ENV NODE_ENV=production PORT=4000
-COPY --from=build /out/node_modules ./node_modules
-COPY --from=build /out/package.json ./package.json
-COPY --from=build /repo/apps/api/dist ./dist
-COPY --from=build /repo/apps/api/seed-assets ./seed-assets
+ENV NODE_ENV=production
+COPY apps/api/.output ./
+COPY apps/api/prisma/migrations ./prisma/migrations
+COPY apps/api/seed-assets ./seed-assets
+
+# applies pending migrations and exits
+FROM app AS migrate
+CMD ["node", "dist/migrate.js"]
+
+FROM app AS runtime
+ENV PORT=4000
 USER node
 EXPOSE 4000
 CMD ["node", "dist/main.js"]