feat: dockerize full stack (web + api + postgres)

- Multi-stage Dockerfiles for API (NestJS, prisma migrate on start) and web (Vite + nginx reverse proxy)
- docker-compose.yml orchestrating db/api/web with healthcheck and persistent volumes
- nginx proxies /api and /avatars to API; web built with relative API URL
- scripts/docker-up.sh: ExFAT-safe wrapper that strips macOS AppleDouble (._*) sidecars before build
- Conditionally register GoogleStrategy only when GOOGLE_CLIENT_ID is set
- Fix unused-variable TS errors blocking production build

scripts/docker-up.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# ExFAT-safe Docker build wrapper.
+#
+# On ExFAT volumes macOS writes "._*" AppleDouble sidecar files for any file
+# with extended attributes. Docker BuildKit reads xattrs while walking the
+# build context and aborts with "operation not permitted" on these sidecars,
+# even though they are in .dockerignore.
+#
+# This script wipes the sidecars in the build contexts right before building
+# so the context walk succeeds. Source on the host is otherwise untouched.
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+ENV_FILE="${ENV_FILE:-.env.docker}"
+
+echo "==> Cleaning macOS AppleDouble (._*) files from build contexts..."
+find apps/api apps/web \( -name "._*" -o -name ".DS_Store" \) -delete 2>/dev/null || true
+
+echo "==> Building and starting containers (env-file: $ENV_FILE)..."
+if [ -f "$ENV_FILE" ]; then
+  exec docker compose --env-file "$ENV_FILE" up -d --build
+else
+  echo "    $ENV_FILE not found; running without --env-file."
+  exec docker compose up -d --build
+fi