Rebuild: a proper deployment for voyager 2

Dockerfile with two targets: app (compiled AdonisJS, production
dependencies, Node 24.16 as in CI) and edge (the Rust worker, cargo
caches as build mounts). deploy/compose.yaml, project usenet-rebuild:
postgres (data on the HDD, catalog tablespace on the NVMe), migrate,
web, coordinator, edge; edge-ts and ace behind profiles.
deploy/deploy.sh (~/bin/deploy-usenet-rebuild on homelab): fetches the
commit (must be on rebuild), builds, migrates, recreates web,
coordinator and edge (the worker stopped first), never postgres.

CI deploys a push to rebuild that passes: the deploy key's forced
command passes "deploy-rebuild <sha>" on. A push to master no longer
deploys from this branch's workflow. deploy/README.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,41 @@
+# syntax=docker/dockerfile:1
+#
+# Voyager 2's images (deploy/compose.yaml):
+#   --target app   the AdonisJS app: web server, coordinator, migrations, ace commands
+#   --target edge  the Rust edge worker (tools/edge-bench-rs, bin edge-node)
+
+# Node is pinned as in CI (.nvmrc): on 24.21, jsonschema 1.5.0 (used by Ace to
+# validate commands) throws "Invalid URL" on $ref, so no ace command starts.
+ARG NODE_VERSION=24.16
+
+# The app, compiled, with production dependencies only.
+FROM node:${NODE_VERSION}-bookworm AS app-build
+WORKDIR /src
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+RUN node ace build \
+ && cd build \
+ && npm ci --omit=dev
+
+FROM node:${NODE_VERSION}-bookworm-slim AS app
+ENV NODE_ENV=production
+WORKDIR /app
+COPY --from=app-build /src/build ./
+USER node
+# Every service picks its own command, e.g. `node ace coordinator:run`.
+CMD ["node", "ace", "list"]
+
+# The Rust worker. Registry and target dir are build caches, so a rebuild only compiles what changed.
+FROM rust:1-bookworm AS edge-build
+WORKDIR /src
+COPY tools/edge-bench-rs ./
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/src/target \
+    cargo build --release --locked --bin edge-node \
+ && cp target/release/edge-node /usr/local/bin/edge-node
+
+FROM debian:bookworm-slim AS edge
+COPY --from=edge-build /usr/local/bin/edge-node /usr/local/bin/edge-node
+USER 1000:1000
+ENTRYPOINT ["/usr/local/bin/edge-node"]