Updated docker

Dockerfile

@@ -1,34 +1,53 @@
 # ── Mozimo — TanStack Start (Vite) ──────────────────────────
-FROM node:lts-trixie-slim AS deps
-# RUN apk add --no-cache libc6-compat
-WORKDIR /app
-COPY package.json yarn.lock* package-lock.json* ./
-RUN \
-  if [ -f yarn.lock ]; then yarn --frozen-lockfile; \
-  elif [ -f package-lock.json ]; then npm ci; \
-  else echo "Lockfile not found." && exit 1; \
-  fi
+# Three-stage build:
+#   deps    — reproducible dependency install (npm ci, cache-mounted)
+#   builder — production build (vite build → dist/)
+#   runner  — lean runtime: production deps + dist + a plain Node server
+#             (no build tooling ships in the final image)
 
-FROM node:lts-trixie-slim AS builder
+ARG NODE_VERSION=24
+
+# ── deps ────────────────────────────────────────────────────
+FROM node:${NODE_VERSION}-trixie-slim AS deps
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN --mount=type=cache,target=/root/.npm \
+    npm ci --no-audit --no-fund
+
+# ── builder ─────────────────────────────────────────────────
+FROM node:${NODE_VERSION}-trixie-slim AS builder
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
-RUN \
-  if [ -f yarn.lock ]; then yarn run build; \
-  elif [ -f package-lock.json ]; then npm run build; \
-  else echo "Lockfile not found." && exit 1; \
-  fi
+RUN npm run build
 
-FROM node:lts-trixie-slim AS runner
+# ── runner ──────────────────────────────────────────────────
+FROM node:${NODE_VERSION}-trixie-slim AS runner
+LABEL org.opencontainers.image.title="Mozimo" \
+      org.opencontainers.image.description="Mozimo — luxury chocolate storefront (TanStack Start + Vite)"
 WORKDIR /app
-ENV NODE_ENV=production
-ENV PORT=3000
-ENV HOST=0.0.0.0
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/public ./public
-COPY --from=builder /app/package.json ./package.json
-COPY --from=builder /app/vite.config.ts ./vite.config.ts
-COPY --from=builder /app/tsconfig.json ./tsconfig.json
+
+ENV NODE_ENV=production \
+    HOST=0.0.0.0 \
+    PORT=3000
+
+# Install production dependencies only (react + @tanstack/* — no vite,
+# tailwind, eslint or typescript ship in the runtime image).
+# The cache mount never lands in image layers, so no cache cleaning needed.
+COPY package.json package-lock.json ./
+RUN --mount=type=cache,target=/root/.npm \
+    npm ci --omit=dev --no-audit --no-fund
+
+COPY --from=builder --chown=root:root /app/dist ./dist
+COPY --chmod=0644 server.mjs ./
+
+# Run as the unprivileged `node` user shipped with the base image.
+USER node
+
 EXPOSE 3000
-CMD ["npm", "start"]
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/',{redirect:'manual'}).then(r=>process.exit(r.status<500?0:1)).catch(()=>process.exit(1))"
+
+# Exec form: node runs as PID 1 and server.mjs handles SIGTERM gracefully.
+CMD ["node", "server.mjs"]