fix(docker): copy scripts/ before npm ci so the fail-loud postinstall can run

The root postinstall runs scripts/link-libsodium.mjs, but the Dockerfile
never copied scripts/ into either stage - npm ci ran with only the
package.json files present, so the script was missing and npm exited 1.

This was latent until the postinstall stopped ending in `|| true`. The old
shell one-liner swallowed its own failure, so a missing script looked like a
successful install; making it fail-loud surfaced the gap on the first build
after that change.

CI did not catch it because actions/checkout gives the workflow a full
working tree, so scripts/ is always present there. Only the image build
exercises the COPY set, and only the deploy workflow builds the image.

Verified: with scripts/ present the postinstall exits 0 ("already matches the
source, nothing to do"); without it, node throws MODULE_NOT_FOUND, which is
the exact failure in the deploy logs. libsodium-sumo is a production
dependency (dev=false), so the --omit=dev runtime stage installs it and the
script finds its source there too.

Dockerfile

@@ -3,6 +3,11 @@ WORKDIR /app
 COPY package*.json ./
 COPY packages/shared/package.json ./packages/shared/
 COPY packages/builder/package.json ./packages/builder/
+# The root postinstall runs scripts/link-libsodium.mjs, so that script has to be
+# present before `npm ci`, not with the later source COPY. It is fail-loud by
+# design (the old shell one-liner ended in `|| true` and silently no-opped), so a
+# missing script fails the build here rather than shipping a broken image.
+COPY scripts/ ./scripts/
 RUN npm ci
 COPY packages/ ./packages/
 RUN npm run build
@@ -12,6 +17,8 @@ WORKDIR /app
 COPY package*.json ./
 COPY packages/shared/package.json ./packages/shared/
 COPY packages/builder/package.json ./packages/builder/
+# Same reason as the builder stage: postinstall needs this before `npm ci`.
+COPY scripts/ ./scripts/
 RUN npm ci --omit=dev
 COPY --from=builder /app/packages/builder/build/ ./packages/builder/build/
 EXPOSE 3000