fix(v2): deterministic Docker build — pin pnpm, fix supply-chain policy, workspace-level install

- Add workspace-level pnpm install in Dockerfile so pnpm-workspace.yaml
  supply-chain settings (onlyBuiltDependencies, allowBuilds) apply uniformly
- Pin pnpm@11.5.2 via corepack with sha1 hash to prevent future policy drift
- Downgrade postcss to ^8.5.22 (8.5.23 was <24h old, violated minimumReleaseAge)
- Regenerate frontend/pnpm-lock.yaml and add root pnpm-lock.yaml for full workspace
- Add binaryTargets to Prisma schema for linux-musl (Alpine) + debian compatibility
- Run pnpm approve-builds to set allowBuilds for esbuild, ssh2, prisma, @prisma/*
- Fix docker-compose.yml: postgres:18-alpine volume at /var/lib/postgresql (not /data)
- Add .env.docker.example; ignore .env.docker in .gitignore

Integration tests (Docker Compose against real Gitea 1.26.2):
✅ Docker image builds cleanly (pnpm frozen-lockfile, no policy violations)
✅ postgres:18-alpine starts healthy
✅ Prisma migrations run on startup
✅ Founder registration and session auth
✅ Gitea connection validated (PAT scope check)
✅ Webhook registered on test repo (Hook ID 11)
✅ PR opened → HMAC verified → preview created → DEPLOY job queued
✅ Gitea PR comment posted (write:issue scope confirmed working)
✅ Deploy fails correctly at AWS step: "Region is missing" (no creds in test env)
✅ PR closed → STOP job created and completed (status DONE)
✅ HMAC rejection: wrong signature → 401
✅ /pp stop via issue_comment webhook → accepted

Blocked (expected): EC2 provisioning requires AWS credentials not present in CI/test env.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -1,22 +1,41 @@
-FROM node:24-alpine AS frontend-builder
-WORKDIR /app/frontend
-COPY frontend/package.json frontend/pnpm-lock.yaml* ./
-RUN npm install -g pnpm && pnpm install --frozen-lockfile
-COPY frontend/ ./
-RUN pnpm build
+# Stage 1: Install all workspace dependencies
+# Using workspace-level install so pnpm-workspace.yaml settings (onlyBuiltDependencies,
+# supply-chain policies, etc.) apply uniformly — the canonical pnpm monorepo pattern.
+FROM node:24-alpine AS deps
+WORKDIR /app
 
-FROM node:24-alpine AS backend-builder
-WORKDIR /app/backend
-COPY backend/package.json backend/pnpm-lock.yaml* ./
-RUN npm install -g pnpm && pnpm install --frozen-lockfile
-COPY backend/ ./
-COPY prisma/ ../prisma/
-RUN pnpm run generate && pnpm run build
+# Copy workspace manifest files first for layer caching
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY frontend/package.json ./frontend/
+COPY backend/package.json ./backend/
+COPY prisma/ ./prisma/
 
+# corepack activates the exact pnpm version declared in package.json#packageManager.
+# This is hash-verified (sha1) and prevents newer pnpm from applying different
+# supply-chain policies (e.g. minimumReleaseAge) against a lockfile generated with
+# the pinned version.
+RUN corepack enable && corepack install && \
+    pnpm install --frozen-lockfile
+
+# Stage 2: Build frontend
+FROM deps AS frontend-builder
+COPY frontend/ ./frontend/
+RUN pnpm --filter pp-frontend run build
+
+# Stage 3: Build backend + Prisma client
+FROM deps AS backend-builder
+COPY backend/ ./backend/
+RUN pnpm --filter pp-backend run generate && \
+    pnpm --filter pp-backend run build
+
+# Stage 4: Minimal production runner
 FROM node:24-alpine AS runner
 WORKDIR /app
 RUN apk add --no-cache openssl
 
+# Root node_modules contains prisma CLI and hoisted deps; backend node_modules has
+# the backend-specific symlinks. Both are needed at runtime.
+COPY --from=backend-builder /app/node_modules ./node_modules
 COPY --from=backend-builder /app/backend/dist ./backend/dist
 COPY --from=backend-builder /app/backend/node_modules ./backend/node_modules
 COPY --from=backend-builder /app/backend/package.json ./backend/package.json
@@ -27,4 +46,4 @@ WORKDIR /app/backend
 
 EXPOSE 5000
 
-CMD sh -c "npx prisma migrate deploy --schema=../prisma/schema.prisma && node dist/index.js"
+CMD sh -c "../node_modules/.bin/prisma migrate deploy --schema=../prisma/schema.prisma && node dist/index.js"