Extract API, migrations and portable NAS deployment

infra/synology/Dockerfile

@@ -0,0 +1,18 @@
+# Build and stage on a trusted workstation first: pnpm image:stage ../delivery-app-web
+# The context contains production artifacts only; Git credentials never enter the image.
+FROM node:22.16.0-bookworm-slim AS standalone
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends nginx-light tini \
+  && rm -rf /var/lib/apt/lists/*
+ENV NODE_ENV=production COOKIE_SECURE=true
+WORKDIR /app
+COPY --chown=node:node .image/api/ /app/
+COPY .image/web/ /usr/share/nginx/html/
+COPY infra/synology/nginx.conf /etc/nginx/model-delivery.conf
+COPY infra/synology/nginx-standalone.conf /etc/nginx/nginx.conf
+COPY infra/synology/start-standalone.mjs /app/start-standalone.mjs
+USER node
+EXPOSE 38080 38081
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:38080/api/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
+ENTRYPOINT ["/usr/bin/tini", "--", "node", "/app/start-standalone.mjs"]