fix(docker): make runner images actually resolvable + standalone layout

- api/worker: overlay package node_modules onto root (dotenv etc.), copy
  @fleetforge/shared at the workspace path the pnpm symlink expects
- web: standalone output nests under apps/web (monorepo outputFileTracingRoot);
  run server.js from WORKDIR /app/apps/web with static/public at that level
- deploy.sh: mount nginx config via named volume ff-nginx-conf (host path /
  cfg does not exist on the host inside the deployer)

infrastructure/deploy/deploy.sh

@@ -12,7 +12,8 @@ set -uo pipefail
 #   /var/run/docker.sock:/var/run/docker.sock
 #   <host>/src:/app/src          persistent git checkout + state
 #   <host>/certs:/certs          TLS certificates (rw, generated on demand)
-#   <host>/nginx:/cfg            rendered nginx config (rw)
+#   ff-nginx-conf:/cfg           shared nginx config named volume (rw)
+#   create: docker volume create ff-nginx-conf
 # ============================================================================
 
 log() { echo "[deployer] $(date '+%F %T') $*"; }
@@ -139,11 +140,13 @@ run_containers() {
     fleetforge/web:latest
 
   log "starting nginx reverse proxy (https $HTTPS_PORT, http $HTTP_PORT)"
+  docker volume create ff-nginx-conf >/dev/null 2>&1 || true
+  cp "$NGINX_SRC" /cfg/fleetforge.conf
   docker run -d --name ff-nginx --restart unless-stopped --network "$NETWORK" \
     -p "$HTTPS_PORT:443" \
     -p "$HTTP_PORT:80" \
     -v "$CERT_DIR:/etc/nginx/certs:ro" \
-    -v "$NGINX_DEST:/etc/nginx/conf.d/fleetforge.conf:ro" \
+    -v "ff-nginx-conf:/etc/nginx/conf.d:ro" \
     nginx:1.27-alpine
 }
 

infrastructure/docker/Dockerfile.api

@@ -19,11 +19,12 @@ RUN pnpm --filter @fleetforge/api build
 FROM node:20-alpine AS runner
 WORKDIR /app
 RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 fleetforge
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/apps/api/node_modules ./node_modules
 COPY --from=builder /app/apps/api/dist ./dist
 COPY --from=builder /app/apps/api/package.json ./
-COPY --from=builder /app/packages/shared/dist ../packages/shared/dist
-COPY --from=builder /app/packages/shared/package.json ../packages/shared/
-COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/packages/shared ./packages/shared
+RUN mkdir -p node_modules/@fleetforge/shared && cp -r packages/shared/dist node_modules/@fleetforge/shared/dist && cp packages/shared/package.json node_modules/@fleetforge/shared/package.json
 USER fleetforge
 EXPOSE 3000
 CMD ["node", "dist/index.js"]

infrastructure/docker/Dockerfile.web

@@ -23,8 +23,9 @@ WORKDIR /app
 ENV NODE_ENV=production
 RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 fleetforge
 COPY --from=builder /app/apps/web/.next/standalone ./
-COPY --from=builder /app/apps/web/.next/static ./.next/static
-COPY --from=builder /app/apps/web/public ./public
+COPY --from=builder /app/apps/web/.next/static ./apps/web/.next/static
+COPY --from=builder /app/apps/web/public ./apps/web/public
+WORKDIR /app/apps/web
 USER fleetforge
 EXPOSE 3001
 CMD ["node", "server.js"]

infrastructure/docker/Dockerfile.worker

@@ -19,8 +19,9 @@ RUN pnpm --filter @fleetforge/worker build
 FROM node:20-alpine AS runner
 WORKDIR /app
 RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 fleetforge
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/apps/worker/node_modules ./node_modules
 COPY --from=builder /app/apps/worker/dist ./dist
 COPY --from=builder /app/apps/worker/package.json ./
-COPY --from=builder /app/node_modules ./node_modules
 USER fleetforge
 CMD ["node", "dist/index.js"]