Docker hardening + first-run fixes

Dockerfile

@@ -30,8 +30,8 @@ WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 
-# Install tools needed for port detection (netcat)
-RUN apk add --no-cache netcat-openbsd
+# Install tools needed for port detection and healthchecks
+RUN apk add --no-cache netcat-openbsd wget
 
 # Create non-root user
 RUN addgroup --system --gid 1001 nodejs
@@ -41,6 +41,11 @@ RUN adduser --system --uid 1001 nextjs
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
+COPY --from=builder --chown=nextjs:nodejs /app/package.json ./
+COPY --from=builder --chown=nextjs:nodejs /app/drizzle ./drizzle
+COPY --from=builder --chown=nextjs:nodejs /app/drizzle.config.ts ./
+COPY --from=builder --chown=nextjs:nodejs /app/src/db/schema.ts ./src/db/schema.ts
 
 # Copy and set up entrypoint script
 COPY --chown=nextjs:nodejs scripts/docker-entrypoint.sh /usr/local/bin/
@@ -59,9 +64,9 @@ EXPOSE 3000-3020
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
 
-# Health check (will use the actual PORT at runtime)
+# Health check (reads dynamic port file when PORT=auto)
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-  CMD wget -q --spider http://localhost:${PORT:-3000}/api/health || exit 1
+  CMD sh -c 'PORT_FILE=/var/run/synapsis/port; PORT=3000; if [ -f "$PORT_FILE" ]; then PORT=$(cat "$PORT_FILE"); fi; case "$PORT" in ""|*[!0-9]*) PORT=3000;; esac; wget -q --spider "http://127.0.0.1:${PORT}/api/health" || exit 1'
 
 # Use entrypoint script for port detection
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]