feat(devops): build minimal non-root multi-stage production image for API and worker

[Songu3020]

#closes
#73
Builds a minimal, non-root production container image for the API and worker processes, following API Roadmap Phase 0: Build Multi-Stage API Production Image.

Changes

• Added a multi-stage Dockerfile in learnault-api/ with separate dependency, build, and runtime stages.
• Generated Prisma Client and compiled TypeScript during the build stage.
• Configured the container to run as a non-root user.
• Added .dockerignore to exclude secrets, tests, coverage, and build tooling from the runtime image.
• Added support for separate API and worker entrypoints.
• Added health check support for the running container.
• Added dependency scanning to catch known vulnerabilities before release.
• Added startup/shutdown tests to verify container lifecycle behavior.
• Added image documentation covering build stages, entrypoints, and usage.

Why

A minimal, non-root production image reduces attack surface, avoids leaking secrets or dev tooling into runtime, and ensures the container starts reliably with only what it needs to run. This is a prerequisite (Phase 0) for staging deployment, rollback, and smoke test work.

Testing

• Verified the built image contains only runtime-necessary dependencies (no dev/build tooling, tests, or coverage files).
• Confirmed the container runs as a non-root user via user inspection.
• Ran a dependency scan and confirmed no unresolved critical findings.
• Tested container startup, health check, and graceful shutdown for both API and worker entrypoints.
• Captured image size/digest, user inspection output, scan results, and smoke test results as verification evidence.

Verification Evidence

• Image size/digest:
• User inspection (non-root confirmation):
• Dependency scan results:
• Health/startup/shutdown smoke test results:

Checklist

• Multi-stage build (dependency, build, runtime)
• Prisma Client generated and TypeScript compiled during build
• Runs as non-root
• Secrets, tests, coverage, and build tooling excluded from runtime
• API/worker entrypoints supported
• Health checks implemented
• Dependency scan passes with no unresolved critical findings
• Startup/shutdown tests pass
• No new YAML config files added

Closes #73