feat: add single-port production docker topology

docker/worker.Dockerfile

@@ -0,0 +1,19 @@
+FROM node:24.18.0-bookworm-slim AS build
+RUN corepack enable && corepack prepare pnpm@10.15.0 --activate
+WORKDIR /app
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY backend/package.json backend/package.json
+COPY frontend/package.json frontend/package.json
+RUN pnpm install --frozen-lockfile
+COPY backend backend
+RUN pnpm --filter backend build:worker
+
+FROM node:24.18.0-bookworm-slim AS runtime
+ENV NODE_ENV=production
+WORKDIR /app
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/backend/node_modules ./backend/node_modules
+COPY --from=build /app/backend/package.json ./backend/package.json
+COPY --from=build /app/backend/dist ./backend/dist
+USER node
+CMD ["node", "backend/dist/apps/worker/src/main.js"]