Add production-ready Docker deployment and workspace recovery

[KhBayazidAhmed]

Summary

This PR adds a production-ready Docker deployment path for ZernFlow and improves recovery for authenticated users whose Supabase workspace setup is incomplete.

What changed

• Add a multi-stage Node.js 24 Alpine image using Next.js standalone output
• Add Docker Compose configuration with an unprivileged user, read-only root filesystem, dropped capabilities, tmpfs caches, graceful shutdown, and restart policy
• Add a lightweight container health endpoint at /api/health
• Keep public Supabase configuration available during the Next.js image build while injecting server secrets only at runtime
• Prevent the dashboard/login redirect loop when a user has no accessible workspace
• Add a guided /setup recovery screen for missing database schema or workspace membership
• Use the server-side service client for secure workspace provisioning
• Add migration 00017_backfill_user_workspaces.sql for accounts created before workspace provisioning was installed
• Document SQL Editor and Supabase CLI migration workflows, Docker deployment, health verification, port configuration, and cron scheduling

Validation

• npm test - 60 tests passed
• npm run lint - 0 errors; existing repository warnings remain
• npm run build - production build passed
• docker compose config --quiet - configuration validated
• Docker image built successfully using the locked dependencies
• Container starts as the unprivileged nextjs user with a read-only root filesystem
• Container health check reaches the application successfully

Deployment notes

1. Copy .env.example to .env and replace every placeholder value.
2. Set NEXT_PUBLIC_APP_URL to the deployment's public HTTPS URL.
3. Apply all numbered Supabase migrations in order. For a new database, supabase/migrations/ALL_MIGRATIONS.sql can be run once through the Supabase SQL Editor.
4. Start the service with docker compose up -d --build.
5. Configure an external scheduler to invoke the two cron endpoints with Authorization: Bearer $CRON_SECRET.

Security notes

• The final image does not contain the Supabase service-role key, cron secret, or AI gateway key.
• Runtime secrets remain environment variables and are not passed as Docker build arguments.
• The existing production dependency tree currently has npm audit advisories; dependency upgrades should be handled separately from this deployment-focused PR.

[vercel]

@KhBayazidAhmed is attempting to deploy a commit to the Zernio Team on Vercel.

A member of the Team first needs to authorize it.