start prod docker migration

rad/Dockerfile.prod

@@ -0,0 +1,44 @@
+FROM python:3.14-slim
+
+# Copy uv helper binary from the uv image so we can manage venvs and pip
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+
+# Install build deps required for common Python packages and netcat for health wait
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+       build-essential \
+       gcc \
+       git \
+       libpq-dev \
+       pkg-config \
+       libcairo2-dev \
+       libgdk-pixbuf2.0-0 \
+       libgdk-pixbuf2.0-dev \
+       libjpeg-dev \
+       zlib1g-dev \
+       wget \
+       ca-certificates \
+       netcat \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /usr/src/app
+
+# Install python deps into a uv-managed venv for reproducible builds
+COPY requirements.txt /usr/src/app/
+RUN uv venv /opt/venv \
+    && export VIRTUAL_ENV=/opt/venv \
+    && export PATH="/opt/venv/bin:$PATH" \
+    && uv pip install --upgrade pip setuptools wheel \
+    && uv pip install --no-cache-dir -r requirements.txt
+
+# Copy project files into image
+COPY . /usr/src/app
+
+# Create non-root user
+RUN useradd -m appuser && chown -R appuser /usr/src/app /opt/venv
+USER appuser
+
+ENTRYPOINT ["/usr/src/app/entrypoint.sh"]