fix(v2): deterministic Docker build — pin pnpm, fix supply-chain policy, workspace-level install

- Add workspace-level pnpm install in Dockerfile so pnpm-workspace.yaml
  supply-chain settings (onlyBuiltDependencies, allowBuilds) apply uniformly
- Pin pnpm@11.5.2 via corepack with sha1 hash to prevent future policy drift
- Downgrade postcss to ^8.5.22 (8.5.23 was <24h old, violated minimumReleaseAge)
- Regenerate frontend/pnpm-lock.yaml and add root pnpm-lock.yaml for full workspace
- Add binaryTargets to Prisma schema for linux-musl (Alpine) + debian compatibility
- Run pnpm approve-builds to set allowBuilds for esbuild, ssh2, prisma, @prisma/*
- Fix docker-compose.yml: postgres:18-alpine volume at /var/lib/postgresql (not /data)
- Add .env.docker.example; ignore .env.docker in .gitignore

Integration tests (Docker Compose against real Gitea 1.26.2):
✅ Docker image builds cleanly (pnpm frozen-lockfile, no policy violations)
✅ postgres:18-alpine starts healthy
✅ Prisma migrations run on startup
✅ Founder registration and session auth
✅ Gitea connection validated (PAT scope check)
✅ Webhook registered on test repo (Hook ID 11)
✅ PR opened → HMAC verified → preview created → DEPLOY job queued
✅ Gitea PR comment posted (write:issue scope confirmed working)
✅ Deploy fails correctly at AWS step: "Region is missing" (no creds in test env)
✅ PR closed → STOP job created and completed (status DONE)
✅ HMAC rejection: wrong signature → 401
✅ /pp stop via issue_comment webhook → accepted

Blocked (expected): EC2 provisioning requires AWS credentials not present in CI/test env.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

pnpm-workspace.yaml

@@ -2,13 +2,13 @@ packages:
   - backend
   - frontend
 allowBuilds:
-  '@prisma/client': set this to true or false
-  '@prisma/engines': set this to true or false
-  bufferutil: set this to true or false
-  cpu-features: set this to true or false
-  esbuild: set this to true or false
-  prisma: set this to true or false
-  ssh2: set this to true or false
+  '@prisma/client': true
+  '@prisma/engines': true
+  bufferutil: true
+  cpu-features: true
+  esbuild: true
+  prisma: true
+  ssh2: true
 onlyBuiltDependencies:
   - '@prisma/client'
   - '@prisma/engines'