Harden authentication, tenant isolation and security boundaries

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine AS base
+FROM node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402 AS base
 
 WORKDIR /app
 
@@ -28,6 +28,10 @@ COPY . .
 
 RUN npm run build:prod
 
+# Separate administrative image; never ship the migration CLI in the app runner.
+FROM builder AS migrator
+CMD ["npm", "run", "db:migrate:deploy"]
+
 FROM base AS runner
 
 ENV NODE_ENV=production
@@ -35,10 +39,11 @@ ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
 ENV UPLOAD_DIR=/app/uploads/announcements
 
-COPY --from=builder /app ./
-
-RUN mkdir -p /app/uploads/announcements && chmod +x /app/scripts/start-production.sh
-
+RUN addgroup -S -g 1001 app && adduser -S -u 1001 -G app app
+COPY --from=builder --chown=app:app /app/.next/standalone ./
+COPY --from=builder --chown=app:app /app/.next/static ./.next/static
+COPY --from=builder --chown=app:app /app/public ./public
+RUN mkdir -p /app/uploads/announcements/announcements /app/.next/cache && chown -R app:app /app/uploads /app/.next/cache
+USER app
 EXPOSE 3000
-
-CMD ["./scripts/start-production.sh"]
+CMD ["node", "server.js"]