feat(docker): add all-in-one Dockerfile without Playwright (<200MB target)

Multi-stage build:
- Stage 1: node:20-alpine builds frontend (discarded)
- Stage 2: python:3.11-slim runs backend + serves SPA static files
- Playwright removed from deps (saves ~350MB)
- Uvicorn serves both API and frontend on :8000
- Healthcheck via curl
- Entrypoint with admin bootstrap support

Estimated image size: ~190MB (vs ~550MB with playwright)

backend/requirements-docker.txt

@@ -0,0 +1,57 @@
+annotated-doc==0.0.4
+annotated-types==0.7.0
+anyio==4.12.0
+APScheduler==3.11.2
+attrs==25.4.0
+Authlib==1.6.6
+certifi==2025.11.12
+cffi==2.0.0
+charset-normalizer==3.4.4
+click==8.3.1
+cryptography==46.0.3
+fastapi==0.126.0
+greenlet==3.3.0
+h11==0.16.0
+httpcore==1.0.9
+httpx==0.28.1
+idna==3.11
+jaraco.classes==3.4.0
+jaraco.context==6.0.1
+jaraco.functools==4.3.0
+jeepney==0.9.0
+jsonschema==4.25.1
+jsonschema-specifications==2025.9.1
+keyring==25.7.0
+more-itertools==10.8.0
+pycparser==2.23
+pydantic==2.12.5
+pydantic-settings
+pydantic_core==2.41.5
+python-multipart==0.0.21
+PyYAML==6.0.3
+passlib[bcrypt]
+python-jose[cryptography]
+PyJWT
+RapidFuzz==3.14.3
+referencing==0.37.0
+requests==2.32.5
+rpds-py==0.30.0
+SecretStorage==3.5.0
+SQLAlchemy==2.0.45
+starlette==0.50.0
+typing-inspection==0.4.2
+typing_extensions==4.15.0
+tzlocal==5.3.1
+urllib3==2.6.2
+uvicorn==0.38.0
+websockets==15.0.1
+pandas
+psycopg2-binary
+openpyxl
+GitPython==3.1.44
+itsdangerous
+email-validator
+openai
+tenacity
+Pillow
+ruff>=0.11.0

docker/all-in-one.Dockerfile

@@ -0,0 +1,64 @@
+# ============================================================
+# All-in-One Docker image (no Playwright, <200MB target)
+# ============================================================
+# Build:  docker build -f docker/all-in-one.Dockerfile -t ss-tools:latest .
+# Run:    docker run -p 8000:8000 --env-file backend/.env ss-tools:latest
+#
+# Stages:
+#   1. frontend-builder — node:20-alpine, npm ci + build, discarded
+#   2. runtime — python:3.11-slim, backend deps (no playwright),
+#      copies frontend build, uvicorn serves both SPA + API on :8000
+
+# ── Stage 1: Build Frontend ────────────────────────────────
+FROM node:20-alpine AS frontend-builder
+
+WORKDIR /app/frontend
+
+# Install deps (layer cache when package.json unchanged)
+COPY frontend/package.json frontend/package-lock.json* ./
+RUN npm ci --prefer-offline --no-audit --no-fund
+
+# Build frontend
+COPY frontend/ ./
+RUN npm run build
+
+# ── Stage 2: Runtime ───────────────────────────────────────
+FROM python:3.11-slim AS runtime
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    BACKEND_PORT=8000 \
+    DEBIAN_FRONTEND=noninteractive
+
+WORKDIR /app
+
+# System deps (git for GitPython, curl for healthcheck)
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        curl \
+        git \
+    && rm -rf /var/lib/apt/lists/*
+
+# Python deps (NO playwright — saves ~350MB)
+COPY backend/requirements-docker.txt /app/backend/requirements-docker.txt
+RUN pip install --no-cache-dir -r /app/backend/requirements-docker.txt
+
+# Backend source
+COPY backend/ /app/backend/
+
+# Frontend build (from stage 1)
+COPY --from=frontend-builder /app/frontend/build /app/frontend/build
+
+# Entrypoint
+COPY docker/backend.entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
+
+WORKDIR /app/backend
+
+EXPOSE 8000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD curl -sf http://localhost:8000/ || exit 1
+
+ENTRYPOINT ["/app/entrypoint.sh"]
+CMD ["python", "-m", "uvicorn", "src.app:app", "--host", "0.0.0.0", "--port", "8000"]