[beadboard] Add Dockerfile and GHA build-and-deploy workflow

## Context

BeadBoard does not yet have a container image or a CI pipeline that
produces one. The infra pattern (see `infra/.claude/CLAUDE.md` →
"CI/CD Architecture") is GHA builds + Woodpecker deploys: GHA builds
the image on every push to the default branch, tags it with the
8-character git SHA, and POSTs the tag to Woodpecker to trigger a
`kubectl set image` roll-out.

We follow that exact pattern here, mirroring `broker-sync`'s
`.github/workflows/ci.yml` (the closest functioning example) but
targeting the private `registry.viktorbarzin.me:5050` registry that the
cluster's containerd `hosts.toml` rewrites to the LAN IP for
pull-through.

## This change

### `Dockerfile`

- Three-stage build using `node:20-alpine`:
    1. `deps` — `npm ci` (with devDeps) so the builder has TypeScript
       and ESLint available during `next build`.
    2. `builder` — runs `npm run build`; `NEXT_TELEMETRY_DISABLED=1` to
       suppress the telemetry prompt in CI logs.
    3. `runner` — copies only `.next`, `public`, `node_modules`,
       `package.json`, and `next.config.ts`; runs as a non-root user
       (`nextjs:1001`).
- `CMD ["npm", "start"]` invokes Next.js' production server on port 3000.
- `next.config.ts` does not opt into the `output: 'standalone'` build,
  so we ship the full `node_modules`. We can trim to standalone in a
  follow-up once we confirm all route handlers and SSE endpoints work
  with the standalone tracer.

### `.dockerignore`

- Excludes `.git`, `node_modules`, `.next`, `.beads`, docs, reference
  materials, Remotion assets, and local env files so the build context
  stays small. `.beads` is sensitive (contains the local Dolt snapshot).

### `.github/workflows/build-and-deploy.yml`

- Triggers on `push` to `main` / `master` (upstream uses `main`;
  `master` added so the fork's current branch also publishes).
- `build` job: buildx, login to the private registry via
  `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` secrets, then
  `docker/build-push-action@v6` for `linux/amd64`, tagging both
  `:<8-char-sha>` and `:latest`. GHA layer cache (`type=gha`) is wired.
- `deploy` job: POSTs to Woodpecker's `/api/repos/<id>/pipelines`.
  `WOODPECKER_REPO_ID` is deliberately set to the literal string `TBD`
  with a guard — the repo needs to be registered with Woodpecker before
  the deploy step can fire. Until then the workflow reports success
  with the image tag so the upstream image is still published. The
  pattern, retry loop, and numeric-repo-id convention are lifted from
  `broker-sync/.github/workflows/ci.yml`, which is the canonical
  example in the infra migration doc.

## What is NOT in this change

- No `.woodpecker/deploy.yml` yet — that lives in the infra repo per
  convention (infra serves the deploy step via `kubectl set image`
  against the cluster SA). The orchestrator will register the repo
  and land the deploy side.
- No standalone Next.js build. `output: 'standalone'` changes the
  working directory layout enough to warrant a dedicated follow-up.
- No smoke test on the image. The existing `npm run test` gate
  guarantees code-level correctness; container smoke-tests can be
  added if the image breaks in production.

## Test Plan

### Automated

The GHA workflow itself cannot be exercised locally. YAML parses as
valid GitHub Actions syntax (same shape as `broker-sync/.github/
workflows/ci.yml` which currently runs green). The Dockerfile has
not been built in this commit to avoid dragging a ~700 MB node image
into a local session; the orchestrator should build it in CI first
or with:

```
docker buildx build --platform linux/amd64 -t beadboard:local .
```

Test suite still green:

```
$ node --import tsx --test tests/components/shared/left-panel-filtering.test.ts \
    tests/components/shared/dispatch-button.test.tsx \
    tests/lib/dispatch-prompt.test.ts \
    tests/api/agent-dispatch-route.test.ts \
    tests/api/agent-status-route.test.ts \
    tests/lib/parser.test.ts \
    tests/components/shared/left-panel.test.tsx \
    tests/components/shared/unified-shell-hide-closed-contract.test.ts
# tests 40 pass 40 fail 0
```

### Manual Verification

1. Set repo secrets on GitHub: `REGISTRY_USERNAME`, `REGISTRY_PASSWORD`,
   `WOODPECKER_TOKEN`.
2. Push to `master` (or `main`).
3. Expected: `build` job succeeds; image appears at
   `registry.viktorbarzin.me:5050/beadboard:<sha>`.
4. `deploy` job: with `WOODPECKER_REPO_ID` still `TBD`, logs the image
   tag and exits 0. Once the repo is registered, replace `TBD` with the
   numeric id and the deploy will trigger the cluster roll-out.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,24 @@
+.git
+.github
+node_modules
+.next
+out
+.vscode
+.idea
+.DS_Store
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+*.log
+coverage
+.env
+.env.local
+.env.development
+.beads
+docs
+reference
+assets
+skills
+help
+install
+remotion.config.ts

.github/workflows/build-and-deploy.yml

@@ -0,0 +1,75 @@
+name: Build and Deploy
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+env:
+  IMAGE_NAME: beadboard
+  REGISTRY: registry.viktorbarzin.me:5050
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.meta.outputs.sha }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - id: meta
+        run: echo "sha=$(echo ${{ github.sha }} | cut -c1-8)" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to private registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          push: true
+          platforms: linux/amd64
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.sha }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push'
+    steps:
+      - name: Trigger Woodpecker deploy
+        env:
+          # TODO: set WOODPECKER_REPO_ID once the beadboard repo is registered
+          # with Woodpecker (infra CLAUDE.md: "Woodpecker API uses numeric repo IDs").
+          WOODPECKER_REPO_ID: "TBD"
+        run: |
+          if [ "$WOODPECKER_REPO_ID" = "TBD" ]; then
+            echo "Woodpecker repo not yet registered — skipping deploy trigger."
+            echo "Image built and pushed as ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build.outputs.image_tag }}"
+            exit 0
+          fi
+          for attempt in 1 2 3; do
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
+              "https://ci.viktorbarzin.me/api/repos/${WOODPECKER_REPO_ID}/pipelines" \
+              -H "Authorization: Bearer ${{ secrets.WOODPECKER_TOKEN }}" \
+              -H "Content-Type: application/json" \
+              -d "{\"branch\":\"main\",\"variables\":{\"IMAGE_TAG\":\"${{ needs.build.outputs.image_tag }}\"}}")
+            if [ "$STATUS" -ge 200 ] && [ "$STATUS" -lt 300 ]; then
+              echo "Woodpecker deploy triggered (HTTP $STATUS)"
+              exit 0
+            fi
+            echo "Attempt $attempt failed (HTTP $STATUS), retrying in 30s..."
+            sleep 30
+          done
+          echo "Failed to trigger Woodpecker deploy after 3 attempts"
+          exit 1

Dockerfile

@@ -0,0 +1,39 @@
+# syntax=docker/dockerfile:1.7
+
+FROM node:20-alpine AS deps
+WORKDIR /app
+ENV NODE_ENV=production
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev=false
+
+
+FROM node:20-alpine AS builder
+WORKDIR /app
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN npm run build
+
+
+FROM node:20-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+
+# Install bd (beads) CLI so the Dolt client can locate it if ever needed.
+RUN apk add --no-cache curl ca-certificates \
+ && addgroup -S nextjs -g 1001 \
+ && adduser -S nextjs -u 1001 -G nextjs
+
+COPY --from=builder --chown=nextjs:nextjs /app/public ./public
+COPY --from=builder --chown=nextjs:nextjs /app/.next ./.next
+COPY --from=builder --chown=nextjs:nextjs /app/node_modules ./node_modules
+COPY --from=builder --chown=nextjs:nextjs /app/package.json ./package.json
+COPY --from=builder --chown=nextjs:nextjs /app/next.config.ts ./next.config.ts
+
+USER nextjs
+EXPOSE 3000
+CMD ["npm", "start"]