feat(deploy): add production Dockerfiles and CI/CD pipeline

- Multi-stage Dockerfile for apps/api (NestJS) and apps/web (Next.js standalone)
- Production docker-compose.prod.yml with all services, health checks, and security
- Real deploy.yml pipeline: build → push to GHCR → deploy staging/production
- .dockerignore for optimized build context
- Enable Next.js standalone output mode

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/Dockerfile

@@ -0,0 +1,42 @@
+# ---- Base ----
+FROM node:22-slim AS base
+RUN corepack enable && corepack prepare pnpm@10.27.0 --activate
+WORKDIR /app
+
+# ---- Dependencies ----
+FROM base AS deps
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json ./
+COPY apps/web/package.json apps/web/
+RUN pnpm install --frozen-lockfile --filter @goodgo/web...
+
+# ---- Build ----
+FROM base AS build
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=deps /app/apps/web/node_modules ./apps/web/node_modules
+COPY tsconfig.base.json ./
+COPY apps/web/ apps/web/
+RUN cd apps/web && npx next build
+
+# ---- Production ----
+FROM node:22-slim AS production
+RUN apt-get update && apt-get install -y --no-install-recommends dumb-init && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV HOSTNAME=0.0.0.0
+ENV PORT=3000
+
+COPY --from=build /app/apps/web/public ./public
+COPY --from=build /app/apps/web/.next/standalone ./
+COPY --from=build /app/apps/web/.next/static ./.next/static
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD node -e "fetch('http://localhost:3000/api/health').then(r => { if (!r.ok) throw 1 }).catch(() => { process.exit(1) })"
+
+USER node
+
+ENTRYPOINT ["dumb-init", "--"]
+CMD ["node", "server.js"]