Run docker installs from the workspace root

Mounting only ./backend and ./frontend into /app made pnpm look for a
per-package lockfile (stale) and miss the workspace-root one entirely,
so --frozen-lockfile failed and root pnpm.onlyBuiltDependencies didn't
apply. Mount the whole repo at /repo, install with --filter from root,
and use the canonical workspace lockfile. Drop the per-package
onlyBuiltDependencies overrides — pnpm warns they're ignored outside
the workspace root.

Pin node:22-bookworm: node:lts now resolves to Node 24, for which
isolated-vm@5.0.3 has no prebuild and won't compile (V8 headers
require C++20).

Gitignore stray per-package lockfiles so they don't drift again.

.gitignore

@@ -11,6 +11,10 @@ node_modules/
 package-lock.json
 yarn.lock
 
+# pnpm: only the workspace-root lockfile is authoritative
+backend/pnpm-lock.yaml
+frontend/pnpm-lock.yaml
+
 # Mac
 .DS_Store
 

backend/package.json

@@ -18,13 +18,5 @@
   "devDependencies": {
     "nodemon": "3.1.14",
     "uuid": "14.0.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "argon2",
-      "isolated-vm",
-      "sharp",
-      "sqlite3"
-    ]
   }
 }

docker-compose.yml

@@ -4,14 +4,15 @@ networks:
 
 services:
   backend:
-    image: node:lts-bookworm
+    image: node:22-bookworm
     container_name: pca_pijac_backend
     restart: unless-stopped
     env_file: ./backend/.env.production
+    working_dir: /repo/backend
     networks:
       - main
     volumes:
-      - ./backend:/app
+      - .:/repo
       - ./data:/data
     labels:
       caddy: admin.pca-pijac.dev.civokram.com
@@ -21,22 +22,24 @@ services:
       - -c
       - |
         npm i -g pnpm
-        cd /app
+        cd /repo
-        pnpm install --production
+        pnpm install --filter ./backend... --frozen-lockfile --prod
+        cd /repo/backend
         rm -f .env
         pnpm run start
 
   frontend:
-    image: node:lts-bookworm
+    image: node:22-bookworm
     container_name: pca_pijac_frontend
     restart: unless-stopped
     env_file: ./frontend/.env.production
+    working_dir: /repo/frontend
     depends_on:
       - backend
     networks:
       - main
     volumes:
-      - ./frontend:/app
+      - .:/repo
     labels:
       caddy: pca-pijac.dev.civokram.com
       caddy.reverse_proxy: '{{upstreams 3000}}'
@@ -45,10 +48,10 @@ services:
       - -c
       - |
         npm i -g pnpm
-        cd /app
+        cd /repo
-        pnpm install --frozen-lockfile
+        pnpm install --filter ./frontend... --frozen-lockfile
+        cd /repo/frontend
         sleep 10
         rm -f .env
         pnpm run build
-        pnpm prune --prod
         pnpm run start

frontend/package.json

@@ -47,10 +47,5 @@
     "tailwindcss": "4.2.4",
     "typescript": "6.0.3",
     "vite": "8.0.10"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ]
   }
 }