fix(docker): openssl in Alpine, binaryTargets for Prisma, IPv4 healthcheck, start_period for migration delay

backend/Dockerfile

@@ -1,4 +1,6 @@
 FROM node:20-alpine AS base
+# Prisma migration engine requires OpenSSL
+RUN apk add --no-cache openssl
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci --only=production
@@ -9,9 +11,12 @@ COPY . .
 CMD ["npm", "run", "dev"]
 
 FROM base AS prod
+# Install prisma CLI for migrate deploy at runtime
+RUN npm install prisma --save-dev
 COPY . .
-# Generate Prisma client in the production image
+# Generate Prisma Client
 RUN npx prisma generate
-# Run as non-root user
+# Fix ownership so the node user can write engine cache
+RUN chown -R node:node /app
 USER node
-CMD ["node", "src/index.js"]
+CMD ["/bin/sh", "/app/docker-entrypoint.sh"]