fix(deploy): resolve permission issues and stabilize asset build context

Dockerfile

@@ -13,6 +13,7 @@ ARG S3_SECRET_KEY
 ARG S3_BUCKET
 ARG S3_REGION
 ARG S3_PREFIX
+ARG BUILD_ID
 
 # Environment variables for Next.js build
 ENV NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
@@ -47,6 +48,10 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     rm .npmrc
 
 # Copy source code
+# We use BUILD_ID here to ensure that if the commit changes, we always COPY the latest files
+# even if Docker's metadata-based fingerprinting for the public directory fails.
+ARG BUILD_ID
+RUN echo "Building with ID: ${BUILD_ID}"
 COPY . .
 
 # Build application (monorepo filter)
@@ -65,6 +70,13 @@ COPY --from=builder /app/apps/web/.next/static ./apps/web/.next/static
 
 # Explicitly copy Payload dynamically generated importMap.js excluded by Standalone tracing
 COPY --from=builder /app/apps/web/app/(payload)/admin/importMap.js ./apps/web/app/(payload)/admin/importMap.js
+
+# Fix permissions for the non-root user (Standard uid/gid from base image)
+# We do this as root before switching users
+USER root
+RUN chown -R 1001:65533 /app
+USER nextjs
+
 # Start from the app directory to ensure references solve correctly
 WORKDIR /app/apps/web
 CMD ["node", "server.js"]