fix(docker): rebuild better-sqlite3 after hardened install

[thanet-s]

Summary

• keep the Docker builder install hardened with --ignore-scripts
• explicitly rebuild better-sqlite3 after install so the native better_sqlite3.node binding exists for the target platform
• smoke-test better-sqlite3 during the image build so missing bindings fail at build time instead of container startup

Fixes #2771

Root Cause

The current ARM64 latest image installs better-sqlite3 without its native binding because broad install scripts are disabled. Startup then fails in bootstrap-env.mjs when it tries to inspect an existing SQLite database.

Validation

• git diff --check
• node -e "require('better-sqlite3')(':memory:').close(); console.log('better-sqlite3 OK')"
• Confirmed the published ARM64 image sha256:3286f8a645d3262427d19b2b806ccd95313f0b3e8716c0d73a6b681e3cf91fd8 lacks /app/node_modules/better-sqlite3/build/Release/better_sqlite3.node and fails the same require smoke test

Full Docker image rebuild was not rerun locally because the current Next.js production build path takes around 30 minutes in this environment; the Dockerfile now includes the exact smoke test in the build layer so CI/image build will catch the native binding failure directly.

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.

[gemini-code-assist]

Code Review

This pull request updates the Dockerfile to rebuild and smoke-test the better-sqlite3 native dependency during the builder stage. However, there is a potential runtime issue: because the runner stage only copies selected files from node_modules, the rebuilt native binary may not be present in the final runner image. It is recommended to explicitly copy better-sqlite3 to the runner stage and run the smoke test there to guarantee the final image is functional.

[thanet-s]

Additional local validation on macOS ARM64 / Docker linux ARM64:

• Host: darwin arm64, Node v24.15.0, ABI 137
• Host smoke test passed: node -e "require("better-sqlite3")(:memory:).close(); console.log("mac better-sqlite3 OK")"
• Docker daemon: linux/arm64 29.4.0
• Built ARM64 image from this branch: docker build --platform linux/arm64 --target runner-base -t omniroute:bs3-arm-test .
• Build passed the new Dockerfile layer: npm ci --ignore-scripts, npm rebuild better-sqlite3, and node -e "require("better-sqlite3")(:memory:).close()"
• Runtime image verification passed: /app/node_modules/better-sqlite3/build/Release/better_sqlite3.node exists, better-sqlite3 loads inside the image, and bootstrap-env.mjs inspected an existing storage.sqlite successfully.
• Standalone startup passed: the container reached normal Next.js startup and DB migrations, docker ps reported healthy, and docker exec omniroute-bs3-arm-test-run node healthcheck.mjs exited 0.

Temporary test container was stopped after validation.

[diegosouzapw]

Thanks @thanet-s for this crucial fix! Hardening with ignore-scripts is a great security default, but rebuilding the native sqlite bindings ensures the container is functional on startup. This has been integrated and will be included in the v3.8.5 release.