build: ship pre-built API bundle; images copy output instead of installing

- API: `pnpm build` bundles dist/ into apps/api/.output (esbuild), with
  Linux musl native packages for sharp and argon2 kept alongside
- docker/api.Dockerfile copies that output; no pnpm install on the server
- add dist/migrate.js (prisma migrate deploy equivalent, same
  _prisma_migrations table and lock) so the Prisma CLI is not needed at runtime
- pnpm-workspace: supportedArchitectures for linux/x64/musl
- admin: apps/admin/.env.production sets VITE_SITE_URL for the production build
- drop NPM_REGISTRY / SITE_URL build args from compose and .env.example
- gitignore: anchor node_modules rules so pre-built node_modules are committed
- README: describe the pre-built deploy flow

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,4 +1,5 @@
-# Production stack. Copy .env.example to .env, fill in the secrets, then:
+# Production stack. The images only copy pre-built output (`pnpm build`, committed), nothing is
+# installed or compiled on the server. Copy .env.example to .env, fill in the secrets, then:
 #   docker compose up -d --build
 #   docker compose exec api node dist/seed/seed.js     # first run only: initial content + admin user
 #
@@ -41,8 +42,6 @@ services:
       context: .
       dockerfile: docker/api.Dockerfile
       target: migrate
-      args:
-        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org/}
     restart: "no"
     depends_on:
       postgres:
@@ -56,8 +55,6 @@ services:
       context: .
       dockerfile: docker/api.Dockerfile
       target: runtime
-      args:
-        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org/}
     restart: unless-stopped
     depends_on:
       migrate:
@@ -88,8 +85,6 @@ services:
     build:
       context: .
       dockerfile: docker/web.Dockerfile
-      args:
-        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org/}
     restart: unless-stopped
     depends_on:
       - api
@@ -103,9 +98,6 @@ services:
     build:
       context: .
       dockerfile: docker/admin.Dockerfile
-      args:
-        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmjs.org/}
-        SITE_URL: https://${SITE_DOMAIN}
     restart: unless-stopped
 
   gateway: