feat(docker): production multi-stage Dockerfile

Three named targets (app, horizon, scheduler) sharing a runtime-base
with PHP 8.3-FPM, opcache, redis, and pinned php-fpm pool config.
Composer + Node build stages are separate so vendor/ and public/build/
are baked into the runtime image.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker/prod-entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -e
+
+cd /var/www/html
+
+# Install Passport keys from Secret-mounted location, if present.
+# Chart mounts the keys at /var/www/html/secrets/oauth-{public,private}.key.
+if [ -f /var/www/html/secrets/oauth-private.key ] \
+   && [ -f /var/www/html/secrets/oauth-public.key ]; then
+    cp /var/www/html/secrets/oauth-private.key storage/oauth-private.key
+    cp /var/www/html/secrets/oauth-public.key storage/oauth-public.key
+    chmod 600 storage/oauth-private.key storage/oauth-public.key
+fi
+
+# Refresh Laravel caches against current env. Safe to run on every boot —
+# config/route/view caching is per-pod and idempotent.
+php artisan config:cache
+php artisan route:cache
+php artisan view:cache
+php artisan event:cache || true
+
+exec "$@"