chore: improve Dockerfile and compose — dep caching, TLS libs, healthchecks, worker, liquid templates

Dockerfile

@@ -1,11 +1,54 @@
-FROM rust:1.85-slim AS builder
-WORKDIR /app
-COPY . .
-RUN cargo build --release -p bootstrap
+# ----- build -----
+FROM rust:slim-bookworm AS builder
 
+WORKDIR /build
+
+# Copy manifests + lockfile first so cargo can fetch deps as a cached layer.
+# Source changes below won't invalidate this layer.
+COPY Cargo.toml Cargo.lock ./
+COPY crates/domain/Cargo.toml              crates/domain/Cargo.toml
+COPY crates/application/Cargo.toml         crates/application/Cargo.toml
+COPY crates/api-types/Cargo.toml           crates/api-types/Cargo.toml
+COPY crates/adapters/sqlite/Cargo.toml     crates/adapters/sqlite/Cargo.toml
+COPY crates/adapters/postgres/Cargo.toml   crates/adapters/postgres/Cargo.toml
+COPY crates/adapters/auth/Cargo.toml       crates/adapters/auth/Cargo.toml
+COPY crates/presentation/Cargo.toml        crates/presentation/Cargo.toml
+COPY crates/bootstrap/Cargo.toml           crates/bootstrap/Cargo.toml
+COPY crates/worker/Cargo.toml              crates/worker/Cargo.toml
+
+# Stub every crate so cargo can resolve and fetch deps without real source
+RUN find crates -name "Cargo.toml" | sed 's|/Cargo.toml||' | \
+    xargs -I{} sh -c 'mkdir -p {}/src && echo "fn main(){}" > {}/src/main.rs && printf "" > {}/src/lib.rs'
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config libssl-dev \
+ && rm -rf /var/lib/apt/lists/*
+
+RUN cargo fetch
+
+# Copy sqlx offline query cache — no live database needed at compile time
+COPY crates/adapters/sqlite/.sqlx ./crates/adapters/sqlite/.sqlx
+
+# Now copy real source — only invalidates cache on source changes
+COPY crates ./crates
+
+ENV SQLX_OFFLINE=true
+RUN cargo build --release -p bootstrap -p worker
+
+# ----- runtime -----
 FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates libssl3 wget \
+ && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
-COPY --from=builder /app/target/release/server ./server
+
+COPY --from=builder /build/target/release/server  ./server
+COPY --from=builder /build/target/release/worker  ./worker
+
 EXPOSE 3000
+
+ENV RUST_LOG=bootstrap=info,tower_http=info
+
 CMD ["./server"]