add first draft working docker setup

docker/Dockerfile

@@ -1,4 +1,7 @@
+# ── Build stage ──────────────────────────────────────────
 FROM node:22-alpine AS builder
+ARG PUBLIC_PB_URL=/pb
+ENV PUBLIC_PB_URL=$PUBLIC_PB_URL
 RUN corepack enable
 WORKDIR /app
 COPY . .
@@ -6,8 +9,12 @@ RUN pnpm install --frozen-lockfile
 RUN pnpm --filter frontend build
 RUN pnpm --filter proxy build
 
+# ── Runtime stage ────────────────────────────────────────
 FROM node:22-alpine
-RUN corepack enable && apk add --no-cache nginx
+ARG PUBLIC_PB_URL=/pb
+ENV PUBLIC_PB_URL=$PUBLIC_PB_URL
+ENV PB_ENDPOINT=http://127.0.0.1:8090
+RUN corepack enable && apk add --no-cache nginx wget unzip ca-certificates
 WORKDIR /app
 COPY --from=builder /app/frontend/build ./frontend/build
 COPY --from=builder /app/proxy/dist ./proxy/dist
@@ -15,8 +22,12 @@ COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/pnpm-lock.yaml ./
 COPY docker/nginx.conf /etc/nginx/http.d/default.conf
 COPY docker/entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
+# Bundle PocketBase (same version as Dockerfile.dev) into the app container.
+RUN wget -qO /tmp/pb.zip https://github.com/pocketbase/pocketbase/releases/download/v0.25.8/pocketbase_0.25.8_linux_amd64.zip \
+    && unzip -o /tmp/pb.zip -d /usr/local/bin/ \
+    && rm /tmp/pb.zip
+RUN chmod +x /entrypoint.sh /usr/local/bin/pocketbase
 ENV FRONTEND_PORT=2080
 ENV PROXY_PORT=3456
-EXPOSE 3001
+EXPOSE 3001 8090
 CMD ["/entrypoint.sh"]