feat(docker): add multi-stage Dockerfile for cm-web-next

docker/web-next/Dockerfile

@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1.7
+
+# --- deps ---
+FROM node:22-alpine AS deps
+WORKDIR /app
+COPY web/package.json web/package-lock.json* ./
+# `npm install` (not `npm ci`) because the host doesn't generate the
+# lockfile during dev. Docker resolves it on first build; subsequent
+# builds reuse the cached layer until package.json changes.
+RUN npm install --no-audit --no-fund
+
+# --- build ---
+FROM node:22-alpine AS build
+WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
+COPY --from=deps /app/node_modules ./node_modules
+COPY web/ ./
+RUN npm run build
+
+# --- runtime ---
+FROM node:22-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+COPY --from=build /app/.next/standalone ./
+COPY --from=build /app/.next/static ./.next/static
+COPY --from=build /app/public ./public
+EXPOSE 3000
+CMD ["node", "server.js"]