chore: improve Dockerfile and compose — dep caching, TLS libs, healthchecks, worker, liquid templates

Dockerfile.liquid

@@ -0,0 +1,56 @@
+# ----- build -----
+FROM rust:slim-bookworm AS builder
+
+WORKDIR /build
+
+# Copy manifests + lockfile first so cargo can fetch deps as a cached layer.
+COPY Cargo.toml Cargo.lock ./
+COPY crates/domain/Cargo.toml              crates/domain/Cargo.toml
+COPY crates/application/Cargo.toml         crates/application/Cargo.toml
+COPY crates/api-types/Cargo.toml           crates/api-types/Cargo.toml
+{% if database == "sqlite" %}COPY crates/adapters/sqlite/Cargo.toml     crates/adapters/sqlite/Cargo.toml
+{% endif %}{% if database == "postgres" %}COPY crates/adapters/postgres/Cargo.toml   crates/adapters/postgres/Cargo.toml
+{% endif %}COPY crates/adapters/auth/Cargo.toml       crates/adapters/auth/Cargo.toml
+COPY crates/presentation/Cargo.toml        crates/presentation/Cargo.toml
+COPY crates/bootstrap/Cargo.toml           crates/bootstrap/Cargo.toml
+{% if worker %}COPY crates/worker/Cargo.toml              crates/worker/Cargo.toml
+{% endif %}
+# Stub every crate so cargo can resolve and fetch deps without real source
+RUN find crates -name "Cargo.toml" | sed 's|/Cargo.toml||' | \
+    xargs -I{} sh -c 'mkdir -p {}/src && echo "fn main(){}" > {}/src/main.rs && printf "" > {}/src/lib.rs'
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config libssl-dev \
+ && rm -rf /var/lib/apt/lists/*
+
+RUN cargo fetch
+
+# For sqlx compile-time query verification run `cargo sqlx prepare` locally first,
+# then commit the .sqlx/ cache. Or pass DATABASE_URL as a build arg:
+#   docker build --build-arg DATABASE_URL=<url> .
+ARG DATABASE_URL
+ENV SQLX_OFFLINE=${DATABASE_URL:+false}
+ENV SQLX_OFFLINE=${SQLX_OFFLINE:-true}
+
+# Now copy real source — only invalidates cache on source changes
+COPY crates ./crates
+
+RUN cargo build --release -p bootstrap{% if worker %} -p worker{% endif %}
+
+# ----- runtime -----
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates libssl3 wget \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY --from=builder /build/target/release/{{project_name}} ./server
+{% if worker %}COPY --from=builder /build/target/release/{{project_name}}-worker ./worker
+{% endif %}
+EXPOSE 3000
+
+ENV RUST_LOG={{project_name}}=info,tower_http=info
+
+CMD ["./server"]