chore(infra): wire MLflow/Airflow env vars, fix healthcheck, add .dockerignore

- docker-compose: pass ML_SERVING_URL, MLFLOW_URL, AIRFLOW_URL + creds to api service
- docker-compose: pass NEXT_PUBLIC_MLFLOW_URL/AIRFLOW_URL to admin service
- docker-compose: replace wget healthcheck with node fetch (wget not in node image)
- docker-compose: enable Airflow basic_auth API backend; add MLflow pip dep for DAGs
- Dockerfiles: tighten layer caching, add .dockerignore

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/docker/Dockerfile.api

@@ -1,32 +1,35 @@
-FROM node:22-alpine AS base
-RUN npm install -g pnpm
+# syntax=docker/dockerfile:1.7
 
-FROM base AS deps
-WORKDIR /app
-COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
-COPY packages/shared-types/package.json ./packages/shared-types/
-COPY services/api/package.json ./services/api/
-RUN pnpm install --frozen-lockfile
+FROM node:22-slim AS base
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      python3 make g++ ca-certificates \
+ && rm -rf /var/lib/apt/lists/* \
+ && npm install -g pnpm
+ENV CI=true \
+    PNPM_HOME=/pnpm \
+    PATH=/pnpm:$PATH
+RUN pnpm config set store-dir /pnpm/store
 
 FROM base AS builder
 WORKDIR /app
-COPY --from=deps /app/node_modules ./node_modules
-COPY --from=deps /app/packages/shared-types/node_modules ./packages/shared-types/node_modules
-COPY --from=deps /app/services/api/node_modules ./services/api/node_modules
-COPY tsconfig.base.json ./
-COPY packages/shared-types ./packages/shared-types
-COPY services/api ./services/api
+COPY pnpm-lock.yaml ./
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm fetch
+COPY . .
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    pnpm install --frozen-lockfile --offline \
+      --filter @oo/api... --filter @oo/shared-types
 RUN pnpm --filter @oo/shared-types build
 RUN pnpm --filter @oo/api build
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    pnpm --filter @oo/api --prod deploy --legacy /deploy \
+ && cp -r services/api/dist /deploy/dist \
+ && rm -rf /deploy/node_modules/@oo/shared-types/src \
+ && cp -r packages/shared-types/dist /deploy/node_modules/@oo/shared-types/dist
 
-FROM node:22-alpine AS runner
+FROM node:22-slim AS runner
 WORKDIR /app
-RUN npm install -g pnpm
-COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
-COPY packages/shared-types/package.json ./packages/shared-types/
-COPY services/api/package.json ./services/api/
-RUN pnpm install --prod --frozen-lockfile
-COPY --from=builder /app/packages/shared-types/dist ./packages/shared-types/dist
-COPY --from=builder /app/services/api/dist ./services/api/dist
-WORKDIR /app/services/api
+ENV NODE_ENV=production
+COPY --from=builder /deploy/package.json ./
+COPY --from=builder /deploy/node_modules ./node_modules
+COPY --from=builder /deploy/dist ./dist
 CMD ["node", "dist/index.js"]