fix: ship full prod node_modules to runner so prisma migrate deploy works

The previous container restart loop ("Error: Cannot find module 'effect'")
happened because the runner stage cherry-picked only specific Prisma
subdirs (.prisma, @prisma, prisma) but missed transitive runtime deps
of the Prisma CLI — like @prisma/config's dep on `effect`.

Cherry-picking is fragile: any minor Prisma upgrade changes the
required dep set and the container stops booting.

Real fix: introduce a dedicated prod-deps stage that runs
`npm ci --omit=dev --include=optional` and ship the resulting
node_modules wholesale to the runner. Trade-off: the runner image
grows by ~200-300MB, gaining bullet-proof prod CLI execution in
exchange. Subsequent rebuilds are fully cached after the first run.

What changed in Dockerfile:
- New stage `prod-deps` produces a prod-only node_modules tree
- Runner stage drops the explicit @prisma/prisma/sharp/@img copies
  (they're already in prod-deps' node_modules)
- Still copies prisma/, prisma.config.ts, .prisma generated client,
  and Next.js standalone artefacts
- CMD unchanged: migrate deploy + server.js

Dockerfile

@@ -3,9 +3,9 @@
 # Next.js 16 + Prisma + next-intl + AI SDK
 # ═══════════════════════════════════════════════════════════════
 
-# ── Stage 1: Install dependencies ──
+# ── Stage 1: Install ALL dependencies (dev + prod) ──
+# Used by the builder to compile, type-check and bundle.
 FROM node:22-alpine AS deps
-# libc6-compat: glibc shim for prebuilt native binaries (Prisma engines)
 RUN apk add --no-cache libc6-compat
 WORKDIR /app
 
@@ -18,25 +18,37 @@ COPY package.json package-lock.json ./
 # no extra Dockerfile gymnastics.
 RUN npm ci --include=optional --no-audit --no-fund
 
-# ── Stage 2: Build the application ──
+# ── Stage 2: Production-only dependencies ──
+# Same install but trimmed to prod tree. The runner stage uses this
+# instead of cherry-picking individual node_modules subdirs — that
+# approach broke when prisma's CLI tried to require its transitive
+# deps (e.g. "effect") at startup. With the full prod tree present,
+# `prisma migrate deploy` and any other prod CLI just works.
+FROM node:22-alpine AS prod-deps
+RUN apk add --no-cache libc6-compat
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev --include=optional --no-audit --no-fund
+
+# ── Stage 3: Build the application ──
 FROM node:22-alpine AS builder
 WORKDIR /app
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 
-# Prisma: generate client for linux-musl (Alpine)
-# NOTE: dummy URL required because prisma.config.ts calls env("DATABASE_URL")
+# Prisma: generate client for linux-musl (Alpine).
+# Dummy URL required because prisma.config.ts calls env("DATABASE_URL")
 # during generate. The real URL is injected at runtime via docker-compose.
 RUN DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy" npx prisma generate
 
-# Disable telemetry during build
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy"
 
 RUN npm run build
 
-# ── Stage 3: Production runner ──
+# ── Stage 4: Production runner ──
 FROM node:22-alpine AS runner
 WORKDIR /app
 
@@ -50,29 +62,24 @@ RUN apk add --no-cache vips
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs
 
-# Copy public assets (footage, images, GLB models)
+# Public assets (logos, brand SVGs, model files)
 COPY --from=builder /app/public ./public
 
-# Copy standalone build
+# Next.js standalone server + its compiled tree
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 
-# Copy Prisma schema + generated client + CLI binaries (the CLI is needed
-# at runtime so the entrypoint can run `prisma migrate deploy` before the
-# server boots — avoids the "table does not exist" race after schema changes)
+# Full prod-only node_modules so any CLI we run at startup (Prisma, etc.)
+# resolves all its transitive deps. Standalone's bundled node_modules is
+# layered on top; node's resolver finds whichever it needs.
+COPY --from=prod-deps /app/node_modules ./node_modules
+
+# Prisma artefacts (schema, migrations, generated client, CLI)
 COPY --from=builder /app/prisma ./prisma
 COPY --from=builder /app/prisma.config.ts ./prisma.config.ts
 COPY --from=builder /app/node_modules/.prisma ./node_modules/.prisma
-COPY --from=builder /app/node_modules/@prisma ./node_modules/@prisma
-COPY --from=builder /app/node_modules/prisma ./node_modules/prisma
 
-# Copy sharp binary explicitly — Next.js standalone trace usually picks it
-# up, but the @img/sharp-linuxmusl-x64 prebuilt is platform-conditional and
-# can be missed. Copying both directories guarantees runtime availability.
-COPY --from=builder /app/node_modules/sharp ./node_modules/sharp
-COPY --from=builder /app/node_modules/@img ./node_modules/@img
-
-# Copy i18n message files (required by next-intl at runtime)
+# i18n message files (required by next-intl at runtime)
 COPY --from=builder /app/messages ./messages
 
 USER nextjs