Run the whole stack in Docker

- API and web images built with turbo prune; the API image also runs the
  worker and migrations. Non-root, health-checked, Debian slim.
- docker compose up -d --build starts Postgres, Redis (persistent), a
  one-shot migrate job, API, worker and web, in dependency order.
- Fix the API production build (tsup flags moved to a config file) and
  bundle the migration script; silence Postgres NOTICE noise.
- npm run infra:up now starts only Postgres and Redis for hot-reload dev.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

docker-compose.yml

@@ -1,3 +1,22 @@
+# Full stack: `docker compose up -d --build`, then open http://localhost:3737
+# Configuration comes from apps/api/.env (copy apps/api/.env.example first).
+
+x-api: &api
+  build:
+    context: .
+    dockerfile: apps/api/Dockerfile
+  image: musicshare-api:local
+  env_file: apps/api/.env
+  environment:
+    # Inside the compose network, services reach each other by name.
+    DATABASE_URL: postgres://musicshare:musicshare@postgres:5432/musicshare
+    REDIS_URL: redis://redis:6379
+  extra_hosts:
+    # Lets the API reach servers on your machine (e.g. a local Jellyfin) as host.docker.internal
+    - host.docker.internal:host-gateway
+  init: true
+  restart: unless-stopped
+
 services:
   postgres:
     image: postgres:17
@@ -9,9 +28,74 @@ services:
       - "${POSTGRES_PORT:-5447}:5432"
     volumes:
       - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U musicshare -d musicshare"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    restart: unless-stopped
+
   redis:
     image: redis:7
+    # Persist to disk so queued jobs and poll schedules survive restarts.
+    command: ["redis-server", "--appendonly", "yes"]
     ports:
       - "${REDIS_PORT:-6380}:6379"
+    volumes:
+      - redisdata:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    restart: unless-stopped
+
+  # Applies database migrations, then exits. The API and worker wait for it.
+  migrate:
+    <<: *api
+    command: ["node", "dist/db/migrate.js"]
+    restart: "no"
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  api:
+    <<: *api
+    ports:
+      - "${API_PORT:-4000}:4000"
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+      redis:
+        condition: service_healthy
+
+  worker:
+    <<: *api
+    command: ["node", "dist/worker.js"]
+    healthcheck:
+      disable: true
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+      redis:
+        condition: service_healthy
+
+  web:
+    build:
+      context: .
+      dockerfile: apps/web/Dockerfile
+      args:
+        # The URL the *browser* uses to reach the API.
+        NEXT_PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:4000}
+    image: musicshare-web:local
+    ports:
+      - "${WEB_PORT:-3737}:3737"
+    init: true
+    restart: unless-stopped
+    depends_on:
+      api:
+        condition: service_healthy
+
 volumes:
   pgdata:
+  redisdata: