44370f41e5
- .dockerignore excludes .git, node_modules, certs, *.zip - Dockerfile runs as non-root appuser - compose.yml isolates frontend (Caddy only) and backend (DB/cache/media) networks - deploy.sh snapshots binary before pull and rolls back on failed health check