fix: deploy on Dokploy from .env settings with one lean image

[voidash]

What changed

Makes the Docker deployment work from the settings a hosting platform provides, and ships one 286 MB image instead of a 341 MB app image plus a 2.07 GB migration image.

• Settings from .env. Compose required apps/api/.env.local and passed nothing else into the containers. A deployment that supplies settings the usual way, in a .env next to docker-compose.yml, could not start: Compose refused to run without the file, and once it existed the app received only DATABASE_URL and STORAGE_DIR, so it stopped with "Invalid environment configuration". Both files are now optional env files for the app and migrate; .env.local wins where both set a value.

• Production stack for Dokploy. prod-docker-compose.yaml follows Dokploy's Docker Compose rules: settings load from the .env Dokploy writes, the app only exposes 3000 and joins dokploy-network for Traefik, Postgres stays on the stack's own network, data is in named volumes, no container_name. Compose refuses to deploy without AUTH_URL or POSTGRES_PASSWORD, and there is no default database password. docs/deployment.md has step-by-step Dokploy instructions.

• Database credentials from .env. POSTGRES_USER, POSTGRES_PASSWORD and POSTGRES_DB can be set there (defaults unchanged), and DATABASE_URL is built from them.

• No separate migration image. The migration, project-init and GitHub-sync scripts are bundled with bun build into three single files (1.1 MB in total) that plain Node runs from the app image. The migrate service in Compose uses the same image with node scripts/migrate.js, and reads the env file so one-off tasks get GITHUB_TOKEN.

• One migrator everywhere. db:migrate uses Drizzle's built-in migrator, the one the tests already used, instead of drizzle-kit migrate. Both record applied migrations in the same table, so existing databases carry on as they are.

• No unused image optimiser. sharp and libvips (about 19 MB) are left out of the standalone output; no page uses next/image, and images.unoptimized is set.

• No package managers (npm, yarn, corepack) in the runtime image.

• Base images pinned by digest.

• Configurable ports. DB_PORT and API_PORT override the host ports in compose.yaml (defaults unchanged: 5432, 3000), so the stack can run beside another Postgres or app. This was chore: make compose ports configurable #38, folded in here.

Closes #52

Contract impact

• No changes to packages/api-contract

Checks

• bun run lint
• bun run typecheck
• bun run test (150 passed)
• bun run build
• CI's migration step (bun run db:migrate on a clean database) with the new script

Tested with Docker from a clone of this branch:

Check	Result
Image	286 MB (was 341 MB + 2.07 GB); no npm/yarn/corepack, no sharp; runs as node
docker compose up on a fresh database	migrations applied, app healthy in 27 s
node scripts/init-project.js, node scripts/sync-github.js in the image	project initialised, issues synced
Pages and API (/en, /ne, members, issues, project, /v1/*, /health)	200; HTML byte-for-byte the same size as from the old image
Browser: static assets	all 10 same-origin images, fonts and stylesheets load
DB_PORT=15432 API_PORT=13000 docker compose up -d beside a stack holding 5432 and 3000	runs; defaults unchanged
Platform style: only a root .env (custom POSTGRES_PASSWORD, AUTH_URL), no .env.local	settings reach the app, migrations run, app healthy, callback is https://devnepal.gov.np/..., pages 200
prod-docker-compose.yaml without POSTGRES_PASSWORD or AUTH_URL	refuses to deploy, naming the missing setting
prod-docker-compose.yaml with Dokploy-style .env, on a dokploy-network	no host ports; app on both networks, Postgres only on the stack network and unreachable from dokploy-network; callback https://devnepal.gov.np/...; pages 200; node scripts/init-project.js in the app container works; data survives a redeploy
Local style: only apps/api/.env.local	unchanged: its values reach the app, default credentials
drizzle-kit migrate then this image's migration on the same database	nothing applied twice (3 migration rows)
New migrator then drizzle-kit migrate, and the reverse, on fresh databases	identical migration history and tables

Notes for reviewers

outputFileTracingExcludes names Bun's node_modules/.bun/ layout explicitly, because globs do not match that hidden directory. If the package manager changes, those two paths need updating; the build would then include sharp again, not break.

Foundation checklist

• Commits signed off (git commit -s)
• Works in both English and Nepali where applicable (no text changes)
• No secrets or real personal data anywhere in the diff
• Documentation updated (docs/deployment.md, .env.example)

[abhiyandhakal]

@voidash seems like there is a merge conflict.

[abhiyandhakal]

This is likely not reading .env.local