feat(deploy): Docker images for server (API+SPA) and vision + branch-aware build pipeline

Containerize the two non-desktop apps for the booth appliance. The desktop app stays
on its own tag-only release.yml.

- apps/server/Dockerfile: multi-stage node:22-alpine. `pnpm deploy --legacy --prod`
  (NOT prune — the monorepo native better-sqlite3 won't resolve under a root prune)
  yields a self-contained bundle; build stage adds node-gyp toolchain, runtime adds
  libstdc++; non-root, healthcheck. Migrates the mounted DB on boot via a drizzle-kit-
  free runtime migrator (packages/db/scripts/migrate-runtime.mjs) — drizzle-kit is a
  devDep, pruned from prod.
- apps/server/src/static-spa.ts: Fastify serves the built React SPA (one container
  serves API + UI). GET-only fallback to index.html, excludes /api + /health so it never
  shadows the backend; a no-op in dev (no dist). Registered last in server.ts.
- apps/vision/Dockerfile: uv base, --extra alpr, model weights PRE-WARMED into the image
  as the runtime user so fast_alpr boots offline (0 downloads at runtime). Engine env-
  selected (VISION_RECOGNIZER stub|fast_alpr).
- Branch-aware: docker-compose.yml (base) + .dev.yml (build local, stub, ports) +
  .prod.yml (pull pinned, fast_alpr, vision internal, restart always); REGISTRY/TAG from
  env so a branch deploy pulls that branch's image.
- .gitea/workflows/build-images.yml: on push to dev/main, run the full turbo build+lint+
  test gate, then buildx push both images to git.infra.msai.al/mca/parking_solution with
  branch + branch-<sha> tags (registry cache; optional Komodo webhook behind KOMODO_ENABLED).
- .dockerignore excludes **/parking.sqlite* so the signed ledger is NEVER baked.

Verified locally (Docker 29): server image migrates + serves API+SPA (/health 200, /
+ /booth HTML, /api/nope JSON 404, no sqlite outside /data); vision image boots fast_alpr
with 0 runtime downloads; compose stack healthy with server→vision over the private network.

Wiki: new container-deployment.md; vision-service-packaging open Qs resolved; index + log.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

docker-compose.yml

@@ -0,0 +1,42 @@
+# Base stack: the parking SERVER (API + SPA) + the VISION (ANPR) service. Branch-aware via
+# ${REGISTRY}/${TAG} — a deploy on `dev` pulls :dev, on `main` pulls :main. Use an env
+# override file for the environment: docker-compose.dev.yml (build locally, stub recognizer)
+# or docker-compose.prod.yml (pull pinned images, fast_alpr). See
+# wiki/decisions/container-deployment.md.
+#
+#   local dev : docker compose -f docker-compose.yml -f docker-compose.dev.yml up --build
+#   prod      : REGISTRY=… TAG=main docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+
+services:
+  server:
+    image: ${REGISTRY:-git.infra.msai.al/mca/parking_solution}/parking-server:${TAG:-dev}
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: /data/parking.sqlite
+      # Reach the vision service over the private compose network by service name.
+      VISION_URL: http://vision:8089
+      # JWT signing secret MUST be provided at deploy (no insecure default — see auth.ts).
+      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in the env/.env}
+    volumes:
+      - parking-data:/data
+    depends_on:
+      vision:
+        condition: service_started
+    networks:
+      - parking
+
+  vision:
+    image: ${REGISTRY:-git.infra.msai.al/mca/parking_solution}/parking-vision:${TAG:-dev}
+    restart: unless-stopped
+    environment:
+      # Engine: stub (no models) by default; prod override sets fast_alpr.
+      VISION_RECOGNIZER: ${VISION_RECOGNIZER:-stub}
+    networks:
+      - parking
+
+volumes:
+  parking-data:
+
+networks:
+  parking:
+    driver: bridge