Dockerfile: oven/bun:latest, root-run (avoids alpine UID 1000 collision)

Mirrors msbls.de pattern, simplified (no mbrian-core submodule clone).

UID note: oven/bun:1-alpine has a built-in 'bun' user at UID/GID 1000 and
`addgroup -u 1000` on top of it breaks the build silently. mExDraw#14
(commit fc62b9c) lost ~4 weeks of Dokploy deploys to that. Comment in the
Dockerfile so the next person doesn't trip over the same.

Production build verified locally: vite build ✓ (4.08s).

Dockerfile

@@ -0,0 +1,17 @@
+FROM oven/bun:latest
+WORKDIR /app
+
+# Note: oven/bun:1-alpine ships a pre-existing `bun` user/group at UID/GID
+# 1000. We use the non-alpine image (`oven/bun:latest`, root-owned) here to
+# avoid the collision documented in m/mExDraw fc62b9c. If you ever swap to
+# the -alpine variant, run as the bundled `bun` user — do NOT addgroup -u 1000.
+
+COPY package.json bun.lock* ./
+RUN bun install --frozen-lockfile || bun install
+
+COPY . .
+RUN bun run build
+
+ENV HOST=0.0.0.0 PORT=3000
+EXPOSE 3000
+CMD ["bun", "./build/index.js"]