fix: force sharp Alpine binary download in Docker build

Sharp 0.34 ships a separate prebuilt binary per platform tuple as
optionalDependencies (@img/sharp-linuxmusl-x64 for Alpine, -darwin-arm64
for Apple Silicon, etc).

The lock file only records the dev machine's platform binary. `npm ci`
is strict — it installs exactly what's locked and refuses to add
platform-specific entries that weren't there at lock time. Result on
the VPS Alpine x64 build:

  sharp: Attempting to build from source via node-gyp
  sharp: Please add node-gyp to your dependencies

Fix: after the strict `npm ci`, run a separate `npm install --no-save
--cpu=x64 --os=linux --libc=musl sharp`. This downloads the Alpine
binary into node_modules without modifying package.json or the lock,
so the dev's Mac install stays untouched on the next git pull.

This is the recommended pattern from sharp's own docs for cross-target
Docker builds: https://sharp.pixelplumbing.com/install#cross-platform

Dockerfile

@@ -11,9 +11,21 @@ RUN apk add --no-cache libc6-compat vips-dev
 WORKDIR /app
 
 COPY package.json package-lock.json ./
-# --include=optional ensures @img/sharp-linuxmusl-x64 (the Alpine sharp
-# prebuilt binary) is downloaded; otherwise sharp errors at runtime.
-RUN npm ci --include=optional
+
+# Strict, reproducible install for everything that's in the lock file.
+RUN npm ci --include=optional --no-audit --no-fund
+
+# Sharp 0.34 ships a separate binary per (os, libc, cpu) tuple as
+# optionalDependencies. The lock file was generated on the developer
+# machine (e.g. macOS arm64), so it only records THAT platform's binary.
+# `npm ci` is strict and refuses to install platform deps not recorded
+# in the lock — which means the Alpine (linuxmusl-x64) binary is missing,
+# sharp falls back to building from source, and the build fails with
+# "Please add node-gyp to your dependencies".
+#
+# Fix: explicitly fetch the Alpine binary after npm ci. --no-save keeps
+# package.json/lock untouched (no churn back to the dev machine).
+RUN npm install --no-save --include=optional --cpu=x64 --os=linux --libc=musl sharp
 
 # ── Stage 2: Build the application ──
 FROM node:22-alpine AS builder