fix(docker): make runner images actually resolvable + standalone layout

- api/worker: overlay package node_modules onto root (dotenv etc.), copy
  @fleetforge/shared at the workspace path the pnpm symlink expects
- web: standalone output nests under apps/web (monorepo outputFileTracingRoot);
  run server.js from WORKDIR /app/apps/web with static/public at that level
- deploy.sh: mount nginx config via named volume ff-nginx-conf (host path /
  cfg does not exist on the host inside the deployer)

infrastructure/deploy/deploy.sh

@@ -12,7 +12,8 @@ set -uo pipefail
 #   /var/run/docker.sock:/var/run/docker.sock
 #   <host>/src:/app/src          persistent git checkout + state
 #   <host>/certs:/certs          TLS certificates (rw, generated on demand)
-#   <host>/nginx:/cfg            rendered nginx config (rw)
+#   ff-nginx-conf:/cfg           shared nginx config named volume (rw)
+#   create: docker volume create ff-nginx-conf
 # ============================================================================
 
 log() { echo "[deployer] $(date '+%F %T') $*"; }
@@ -139,11 +140,13 @@ run_containers() {
     fleetforge/web:latest
 
   log "starting nginx reverse proxy (https $HTTPS_PORT, http $HTTP_PORT)"
+  docker volume create ff-nginx-conf >/dev/null 2>&1 || true
+  cp "$NGINX_SRC" /cfg/fleetforge.conf
   docker run -d --name ff-nginx --restart unless-stopped --network "$NETWORK" \
     -p "$HTTPS_PORT:443" \
     -p "$HTTP_PORT:80" \
     -v "$CERT_DIR:/etc/nginx/certs:ro" \
-    -v "$NGINX_DEST:/etc/nginx/conf.d/fleetforge.conf:ro" \
+    -v "ff-nginx-conf:/etc/nginx/conf.d:ro" \
     nginx:1.27-alpine
 }