feat(scaffold): Next 16 + Payload 3 scaffold with Kaniko CI and Swarm deploy

Initial app scaffold wired end-to-end: Payload 3.82 CMS integrated with Next
16.2 App Router (standalone output), PostgreSQL 17 adapter, Lexical rich text,
Tailwind 3 with Material 3 token palette ported from the stitch technical-
editorial design, self-hosted Space Grotesk + Inter via next/font, and
lucide-react icons. Admin lives at /admin, REST/GraphQL at /api/*, and
/api/health returns build SHA/REV for deploy verification.

Seven collections (Users, Media, Categories, Projects, Posts, Gear,
ContactSubmissions) and six globals (Home, About, Contact, Resume,
Navigation, SEO) model the content outlined in docs/PRD.md.

Multi-stage Dockerfile builds a non-root standalone runner; Woodpecker
pipeline lints, typechecks, builds, audits, builds with Kaniko to
git.mosaicstack.dev, scans with Trivy, and links the package. Swarm
compose mirrors the mosaic-stack-website Traefik entrypoints=web pattern
with www->apex redirect and immutable WEB_IMAGE_TAG.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,51 @@
+# syntax=docker/dockerfile:1.7
+# =============================================================================
+# jasonwoltje.com — Next.js 16 + Payload 3 production image
+# Multi-stage, non-root, standalone Next output. Built by Kaniko in Woodpecker.
+# =============================================================================
+
+ARG NODE_VERSION=24-alpine
+
+# ---- deps ----
+FROM node:${NODE_VERSION} AS deps
+RUN apk add --no-cache libc6-compat
+WORKDIR /app
+RUN corepack enable && corepack prepare pnpm@10.31.0 --activate
+COPY package.json pnpm-lock.yaml* ./
+RUN --mount=type=cache,target=/pnpm-store \
+    pnpm config set store-dir /pnpm-store && \
+    pnpm install --frozen-lockfile
+
+# ---- build ----
+FROM node:${NODE_VERSION} AS build
+WORKDIR /app
+RUN corepack enable && corepack prepare pnpm@10.31.0 --activate
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+ARG NEXT_PUBLIC_BUILD_SHA=unknown
+ARG NEXT_PUBLIC_BUILD_REV=unknown
+ENV NEXT_PUBLIC_BUILD_SHA=${NEXT_PUBLIC_BUILD_SHA} \
+    NEXT_PUBLIC_BUILD_REV=${NEXT_PUBLIC_BUILD_REV} \
+    NEXT_TELEMETRY_DISABLED=1 \
+    NODE_ENV=production
+RUN pnpm build
+
+# ---- runner ----
+FROM node:${NODE_VERSION} AS runner
+WORKDIR /app
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    PORT=3000 \
+    HOSTNAME=0.0.0.0
+RUN addgroup -g 1001 -S nodejs && adduser -S -u 1001 -G nodejs nextjs
+RUN apk add --no-cache wget && \
+    mkdir -p /app/media && \
+    chown -R nextjs:nodejs /app
+COPY --from=build --chown=nextjs:nodejs /app/public ./public
+COPY --from=build --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=build --chown=nextjs:nodejs /app/.next/static ./.next/static
+USER nextjs
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=45s \
+    CMD wget -qO- http://127.0.0.1:3000/api/health || exit 1
+CMD ["node", "server.js"]