fix(docker): openssl in Alpine, binaryTargets for Prisma, IPv4 healthcheck, start_period for migration delay

backend/Dockerfile

@@ -1,4 +1,6 @@
 FROM node:20-alpine AS base
+# Prisma migration engine requires OpenSSL
+RUN apk add --no-cache openssl
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci --only=production
@@ -9,9 +11,12 @@ COPY . .
 CMD ["npm", "run", "dev"]
 
 FROM base AS prod
+# Install prisma CLI for migrate deploy at runtime
+RUN npm install prisma --save-dev
 COPY . .
-# Generate Prisma client in the production image
+# Generate Prisma Client
 RUN npx prisma generate
-# Run as non-root user
+# Fix ownership so the node user can write engine cache
+RUN chown -R node:node /app
 USER node
-CMD ["node", "src/index.js"]
+CMD ["/bin/sh", "/app/docker-entrypoint.sh"]

backend/prisma/schema.prisma

@@ -1,5 +1,6 @@
 generator client {
   provider      = "prisma-client-js"
+  binaryTargets = ["native", "linux-musl-openssl-3.0.x"]
 }
 
 datasource db {

docker-compose.yml

@@ -34,16 +34,16 @@ services:
       NODE_ENV: production
       PORT: 3001
       CORS_ORIGIN: "http://localhost:52867"
-    # Run as non-root
+    # Non-root user set in Dockerfile; entrypoint runs migrations then starts server
-    user: "node"
     entrypoint: ["/bin/sh", "/app/docker-entrypoint.sh"]
     ports:
       - "3001:3001"
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:3001/health || exit 1"]
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3001/health || exit 1"]
-      interval: 15s
+      interval: 10s
       timeout: 5s
-      retries: 5
+      retries: 10
+      start_period: 40s
 
   frontend:
     build: