feat: package the application for Docker, with deployment docs

Multi-stage build on node:22-alpine, standalone output, non-root user,
healthcheck on /api/health, and migrations applied by the entrypoint
before the first request. A failed migration stops the container rather
than serving an inconsistent database.

Getting the Prisma CLI into the runtime image took three attempts and
the reasoning is recorded in the Dockerfile. Copying it out of the build
stage leaves its transitive dependencies behind; patching them in one at
a time is a losing game. It now gets its own stage and its own tree,
with the schema and prisma.config.ts beside it, and the entrypoint runs
from there so every import resolves locally. The version is read from
our own package.json so it cannot drift from the generated client.

Two things had to change to build without a database, which a build
container rightly does not have. prisma.config.ts no longer reads the
URL through prisma's env() helper, which throws on a missing variable
even for `generate`. And lib/db.ts creates the client on first use
rather than on import: Next imports every route module while collecting
page data, so a module that threw on import failed the build with an
error naming whichever route was analysed first, which says nothing
useful. The failure now lands on the first query, where it belongs.

Verified by running the image against a real database: migrations
applied, cron scheduled in Europe/Zurich, a device paired, and the panel
image served as a genuine 1-bit 800x480 BMP — so satori, resvg and the
vendored fonts all work on musl. The image hash came out identical to
the one produced on the glibc host, which is the reproducibility the
vendored fonts were for.

The production overlay publishes through an existing Traefik, drops the
host port, mounts the filesystem read-only, and adds a nightly dump kept
for a fortnight.

README and DEPLOY are in French and cover what actually bites: the panel
receives nothing and only updates when it wakes; the issuer must match
to the character; the captive portal URL takes no trailing slash; a
rollback across a migration needs the dump, because Prisma does not
undo one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012cSY9pVhZmJUKNN7wf1Myd

lib/db.ts

@@ -2,19 +2,53 @@ import { PrismaPg } from '@prisma/adapter-pg';
 
 import { PrismaClient } from '@/lib/generated/prisma/client';
 
-const connectionString = process.env.DATABASE_URL;
+/**
+ * The Prisma client, created on first use rather than on import.
+ *
+ * Next imports every route module while collecting page data at build time, in
+ * a container that has no database and no DATABASE_URL. A module that threw on
+ * import would fail the build with an error pointing at whichever route
+ * happened to be analysed first, which says nothing useful. Creating the
+ * client lazily moves that failure to the first actual query, where the
+ * message is about the database because the problem is.
+ */
 
-if (!connectionString) {
-  throw new Error('DATABASE_URL is not set');
-}
-
-// Next.js hot-reloads modules in development; without this the dev server
-// would open a new pool on every edit until Postgres refuses connections.
 const globalForPrisma = globalThis as unknown as { prisma?: PrismaClient };
 
-export const prisma =
-  globalForPrisma.prisma ?? new PrismaClient({ adapter: new PrismaPg({ connectionString }) });
+function client(): PrismaClient {
+  if (globalForPrisma.prisma) {
+    return globalForPrisma.prisma;
+  }
 
-if (process.env.NODE_ENV !== 'production') {
-  globalForPrisma.prisma = prisma;
+  const connectionString = process.env.DATABASE_URL;
+  if (!connectionString) {
+    throw new Error(
+      'DATABASE_URL n’est pas défini : impossible de joindre la base de données.',
+    );
+  }
+
+  const created = new PrismaClient({ adapter: new PrismaPg({ connectionString }) });
+
+  // Next hot-reloads modules in development; without this the dev server would
+  // open a new pool on every edit until Postgres refuses connections.
+  if (process.env.NODE_ENV !== 'production') {
+    globalForPrisma.prisma = created;
+  }
+  return created;
 }
+
+let singleton: PrismaClient | undefined;
+
+function instance(): PrismaClient {
+  singleton ??= client();
+  return singleton;
+}
+
+export const prisma: PrismaClient = new Proxy({} as PrismaClient, {
+  get(_target, property) {
+    const target = instance();
+    const value = Reflect.get(target, property) as unknown;
+    // Model delegates and methods both need their original `this`.
+    return typeof value === 'function' ? value.bind(target) : value;
+  },
+});