fix(deploy): pass build-time secrets and fix standalone path resolution

Dockerfile

@@ -13,6 +13,8 @@ ARG S3_SECRET_KEY
 ARG S3_BUCKET
 ARG S3_REGION
 ARG S3_PREFIX
+ARG DATABASE_URI
+ARG PAYLOAD_SECRET
 ARG BUILD_ID
 
 # Environment variables for Next.js build
@@ -25,6 +27,8 @@ ENV S3_SECRET_KEY=$S3_SECRET_KEY
 ENV S3_BUCKET=$S3_BUCKET
 ENV S3_REGION=$S3_REGION
 ENV S3_PREFIX=$S3_PREFIX
+ENV DATABASE_URI=$DATABASE_URI
+ENV PAYLOAD_SECRET=$PAYLOAD_SECRET
 ENV SKIP_RUNTIME_ENV_VALIDATION=true
 ENV CI=true
 
@@ -78,5 +82,6 @@ RUN chown -R 1001:65533 /app
 USER nextjs
 
 # Start from the app directory to ensure references solve correctly
-WORKDIR /app/apps/web
-CMD ["node", "server.js"]
+# In Standalone mode, Next.js expects node_modules and public relative to the server.js
+WORKDIR /app
+CMD ["node", "apps/web/server.js"]