Base the release image on scratch

Build the backend as a fully static musl binary (rust:1-alpine +
x86_64-unknown-linux-musl) and run it in a scratch image with only the
binary and the compiled frontend: 32 MB instead of ~110 MB, no shell,
package manager or libc, running as the numeric user 10001:10001.

The binary moves to /usr/local/bin/tavolo so `tavolo migrate` and
`tavolo serve` resolve on PATH in compose and Kubernetes. TLS for OIDC and
Postgres validates against Mozilla's roots embedded in the binary by
webpki-roots, so no certificate files are needed; the OTLP client is built
without a TLS backend, so OTEL_EXPORTER_OTLP_ENDPOINT must be http://
(documented). The Docker HEALTHCHECK is removed since scratch has no curl:
Kubernetes probes /api/health over HTTP and Compose gates on its dependency
checks. `strip = "symbols"` trims the release binary.

Validated with docker compose up --build: migrations, sessions, lobby
creation, the OIDC discovery redirect and the SPA all work, proving musl DNS
resolution for the postgres/redis/mockoauth service names.

server/Dockerfile

@@ -3,13 +3,22 @@
 # Sycamore/WASM frontend). The Docker build context is the REPOSITORY ROOT
 # (see docker-compose.yml) so this single image assembles both parts:
 #
-#   web-builder   rust + trunk -> compiles web/ into web/dist
-#   rust-builder  rust          -> compiles server/ into the tavolo binary
-#   runtime       debian slim   -> the binary + the compiled frontend
+#   web-builder   rust + trunk  -> compiles web/ into web/dist
+#   rust-builder  rust (alpine) -> compiles server/ into a static musl binary
+#   runtime       scratch       -> static binary + compiled frontend
 #
-# The backend embeds its sqlx migrations, serves /static and /assets itself
-# and hosts the SPA shell, so the runtime image needs no Python, Granian or
-# migration files.
+# The runtime is a scratch image: the backend is a fully static musl binary,
+# embeds its sqlx migrations and serves /static, /assets and the SPA shell
+# itself, so no shell, package manager or libc is needed.
+#
+# TLS trust model: the OIDC client (reqwest 0.12) and Postgres (sqlx) validate
+# against Mozilla's roots embedded in the binary by the webpki-roots crate, so
+# no certificate files exist in the image. The OTLP exporter is built without
+# a TLS backend, so OTEL_EXPORTER_OTLP_ENDPOINT must be http:// (terminate TLS
+# in front of the collector if needed).
+#
+# There is deliberately no HEALTHCHECK (no curl in scratch): Kubernetes
+# probes /api/health over HTTP, and Compose gates on its dependency checks.
 #
 # Build and run it with (from the repository root):
 #   docker compose up --build
@@ -47,8 +56,11 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/web/target \
     trunk build --release --public-url /static/
 
-# --- Rust builder ------------------------------------------------------------
-FROM rust:1-slim-bookworm AS rust-builder
+# --- Rust builder (static musl) ----------------------------------------------
+FROM rust:1-alpine AS rust-builder
+
+# ring (the only C dependency) compiles with the musl toolchain from build-base.
+RUN apk add --no-cache build-base
 
 WORKDIR /build
 
@@ -59,37 +71,24 @@ COPY server/crates ./crates
 # and the binary is copied out of the mount into the image layer.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/build/target \
-    cargo build --release --locked \
- && cp target/release/tavolo /tavolo
+    cargo build --release --locked --target x86_64-unknown-linux-musl \
+ && cp target/x86_64-unknown-linux-musl/release/tavolo /tavolo
 
-# --- Runtime -----------------------------------------------------------------
-FROM debian:bookworm-slim
+# --- Runtime (scratch) --------------------------------------------------------
+FROM scratch
 
-# The slim base ships no CA store; seed it from the builder so the HTTPS apt
-# mirrors (and later, outbound TLS) can be verified.
-COPY --from=web-builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    { sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list 2>/dev/null || true; } \
- && { sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; } \
- && apt-get update \
- && apt-get install -y --no-install-recommends ca-certificates curl tzdata \
- && rm -rf /var/lib/apt/lists/* \
- && addgroup --system app && adduser --system --ingroup app app
-
-COPY --from=rust-builder /tavolo /usr/local/bin/tavolo
+# Fully static musl binary; no libc, shell or package manager in the image.
+# Installed on PATH so `tavolo migrate` / `tavolo serve` work as commands.
+COPY --from=rust-builder --chmod=755 /tavolo /usr/local/bin/tavolo
 # The compiled single-page application: hashed js/wasm/css under /static and
 # the card images under /assets (mounted by the server from STATIC_DIR).
 COPY --from=web-builder /web/dist /app/web/dist
 
 ENV STATIC_DIR=/app/web/dist
 
-USER app
+# Numeric user: scratch has no /etc/passwd and Kubernetes verifies runAsNonRoot.
+USER 10001:10001
 
 EXPOSE 8080
 
-HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
-  CMD curl -fsS http://127.0.0.1:8080/api/health || exit 1
-
 CMD ["tavolo", "serve"]