Three-stage build:
1. node:22-alpine — `npm ci` + `npm run build` produces frontend/dist
2. python:3.12-slim — poetry installs backend deps into a venv
3. python:3.12-slim — runtime, copies the venv + frontend/dist,
sets FRONTEND_DIST=/app/frontend_dist
Backend gates the API surface on FRONTEND_DIST:
- Unset (dev / tests): routers mount at root (/networth, /scenarios,
…). 172 tests still pass unchanged. The Vite dev server proxies
`/api/*` → backend stripping the prefix.
- Set (prod): routers mount under `/api/*`. The SPA bundle mounts at
`/` with html=True so React Router owns client routing for paths
like `/scenarios`, `/what-if`. Same-origin, no CORS, one deploy.
Operational endpoints (`/healthz`, `/metrics`, `/recompute`) stay at
root in both shapes.
Existing Woodpecker pipeline picks this up unchanged — same context,
same Dockerfile path, just produces a richer image.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
