fix: clear stale APT lists before apt-get update in Dockerfiles

Kaniko's layer extraction can leave base-image APT metadata with
expired GPG signatures, causing "invalid signature" failures during
apt-get update in CI builds. Adding rm -rf /var/lib/apt/lists/*
before apt-get update ensures a clean state.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/Dockerfile

@@ -86,7 +86,11 @@ RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 RUN corepack enable && corepack prepare pnpm@10.27.0 --activate
 
 # Install dumb-init for proper signal handling
-RUN apt-get update && apt-get install -y --no-install-recommends dumb-init \
+# Clear stale APT lists first — Kaniko's layer extraction can leave
+# base-image metadata with expired GPG signatures (bookworm InRelease).
+RUN rm -rf /var/lib/apt/lists/* \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends dumb-init \
     && rm -rf /var/lib/apt/lists/*
 
 # Create non-root user