feat: Add Docker build & push to Woodpecker CI pipeline

- Add docker-build-api, docker-build-web, docker-build-postgres steps
- Images pushed to reg.diversecanvas.com/mosaic/* on main/develop
- Create docker-compose.prod.yml for production deployments
- Add .env.prod.example with production configuration

Requires Harbor secrets in Woodpecker:
- harbor_username
- harbor_password

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.woodpecker.yml

@@ -78,3 +78,76 @@ steps:
       - typecheck # Only block on critical checks
       - security-audit
       - prisma-generate
+
+  # ======================
+  # Docker Build & Push (main/develop only)
+  # ======================
+  # Requires secrets: harbor_username, harbor_password
+
+  docker-build-api:
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      registry: reg.diversecanvas.com
+      repo: reg.diversecanvas.com/mosaic/api
+      dockerfile: apps/api/Dockerfile
+      context: .
+      platforms:
+        - linux/amd64
+      tags:
+        - "${CI_COMMIT_SHA:0:8}"
+        - latest
+      username:
+        from_secret: harbor_username
+      password:
+        from_secret: harbor_password
+    when:
+      - branch: [main, develop]
+        event: push
+    depends_on:
+      - build
+
+  docker-build-web:
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      registry: reg.diversecanvas.com
+      repo: reg.diversecanvas.com/mosaic/web
+      dockerfile: apps/web/Dockerfile
+      context: .
+      platforms:
+        - linux/amd64
+      build_args:
+        - NEXT_PUBLIC_API_URL=https://api.mosaicstack.dev
+      tags:
+        - "${CI_COMMIT_SHA:0:8}"
+        - latest
+      username:
+        from_secret: harbor_username
+      password:
+        from_secret: harbor_password
+    when:
+      - branch: [main, develop]
+        event: push
+    depends_on:
+      - build
+
+  docker-build-postgres:
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      registry: reg.diversecanvas.com
+      repo: reg.diversecanvas.com/mosaic/postgres
+      dockerfile: docker/postgres/Dockerfile
+      context: docker/postgres
+      platforms:
+        - linux/amd64
+      tags:
+        - "${CI_COMMIT_SHA:0:8}"
+        - latest
+      username:
+        from_secret: harbor_username
+      password:
+        from_secret: harbor_password
+    when:
+      - branch: [main, develop]
+        event: push
+    depends_on:
+      - build