feat(docker): multi-stage Dockerfiles with npmmirror registry

Rewrites dashboard and finder Dockerfiles to use a clean multi-stage
build (deps → builder → runner) that installs npm packages inside
Alpine Linux, avoiding the SWC musl binary issue when building from
Windows host. Uses registry.npmmirror.com for reliable installs from
restricted networks (Iran).

- docker/api/Dockerfile: .NET 10 multi-stage build
- docker/web/Dockerfile: Node 20-alpine multi-stage, npmmirror
- docker/finder/Dockerfile: Node 20-alpine multi-stage, npmmirror
- docker/website/Dockerfile: marketing website build
- scripts/: PowerShell helper scripts for local dev

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docker/api/Dockerfile

@@ -0,0 +1,39 @@
+# Base images: override via docker-compose build args or .env (see docs/DOCKER.md).
+# Default = Microsoft Container Registry (official). Docker Hub dotnet/* often returns
+# "insufficient_scope" unless logged in, or is unreachable in some regions.
+ARG DOTNET_SDK_IMAGE=mcr.microsoft.com/dotnet/sdk:10.0
+ARG DOTNET_ASPNET_IMAGE=mcr.microsoft.com/dotnet/aspnet:10.0
+
+FROM ${DOTNET_SDK_IMAGE} AS build
+WORKDIR /src
+
+COPY global.json Directory.Build.props Directory.Packages.props nuget.config ./
+
+COPY src/Meezi.Shared/Meezi.Shared.csproj src/Meezi.Shared/
+COPY src/Meezi.Core/Meezi.Core.csproj src/Meezi.Core/
+COPY src/Meezi.Infrastructure/Meezi.Infrastructure.csproj src/Meezi.Infrastructure/
+COPY src/Meezi.API/Meezi.API.csproj src/Meezi.API/
+
+# NuGet over TLS often fails in Docker when VPN/filter/antivirus breaks HTTPS (bad record mac).
+# Retry via nuget.config; offline revocation helps restricted networks. Re-run build if restore fails.
+ENV NUGET_CERT_REVOCATION_MODE=offline
+RUN --mount=type=cache,target=/root/.nuget/packages \
+    dotnet restore src/Meezi.API/Meezi.API.csproj --disable-parallel
+
+COPY src/ src/
+COPY data/menu-image-manifest.json data/
+COPY data/demo-credentials.json data/
+RUN dotnet publish src/Meezi.API/Meezi.API.csproj -c Release -o /app/publish /p:UseAppHost=false
+
+FROM ${DOTNET_ASPNET_IMAGE} AS runtime
+WORKDIR /app
+
+# No apt-get here — avoids Ubuntu mirror downloads during build (Iran/VPN issues).
+# Healthcheck uses a TCP probe (see docker-compose.yml).
+
+ENV ASPNETCORE_URLS=http://+:8080
+EXPOSE 8080
+
+COPY --from=build /app/publish .
+
+ENTRYPOINT ["dotnet", "Meezi.API.dll"]