chore(container): add build ARGs for Sentry and Turnstile env vars

Declare build-time ARG instructions for PUBLIC_TURNSTILE_SITE_KEY,
VITE_SENTRY_DSN, SENTRY_DSN, SENTRY_ORG, SENTRY_PROJECT, and
SENTRY_AUTH_TOKEN so CI can pass them via --build-arg. TURNSTILE_SECRET_KEY
and SENTRY_DSN are runtime-only and injected via -e at container run time.
Also removes TURNSTILE_SECRET_KEY from .env.example (runtime secret,
not a build-time value).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -2,7 +2,6 @@
 # (Vite dev proxy in dev, Caddy in prod — see vite.config.ts / Caddyfile).
 # No API_BASE_URL override needed.
 PUBLIC_TURNSTILE_SITE_KEY=0x4AAAAAACI5pu-lNWFc6Wu1
-TURNSTILE_SECRET_KEY=
 
 # Sentry — error monitoring, tracing, session replay, logging
 # VITE_SENTRY_DSN is public (bundled into the browser build)

Containerfile

@@ -4,6 +4,12 @@ WORKDIR /srv
 COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
 RUN pnpm install --frozen-lockfile
 COPY . .
+ARG PUBLIC_TURNSTILE_SITE_KEY
+ARG VITE_SENTRY_DSN
+ARG SENTRY_DSN
+ARG SENTRY_ORG
+ARG SENTRY_PROJECT
+ARG SENTRY_AUTH_TOKEN
 RUN pnpm build
 
 FROM node:22-alpine AS runtime
@@ -11,6 +17,7 @@ WORKDIR /srv
 ENV NODE_ENV=production
 ENV PORT=3000
 ENV HOST=0.0.0.0
+COPY --from=builder /srv/node_modules ./node_modules
 COPY --from=builder /srv/build ./build
 COPY --from=builder /srv/package.json ./
 EXPOSE 3000