fix(docker,ci): fix two CI/CD failures

1. pnpm-lock.yaml outdated (ERR_PNPM_OUTDATED_LOCKFILE)
   apps/template/backend was added to the workspace but pnpm install
   was never run — lockfile had empty specifiers for that package.
   Fixed by running pnpm install at root.

2. Docker build: better-sqlite3 node-gyp fails — no Python in node:22-slim
   - Builder stage: add python3 make g++ via apt before pnpm install
   - Runtime stage: replace 'npm install --omit=dev --ignore-scripts'
     (which breaks native modules) with 'pnpm deploy --prod' in builder
     then copy the flat deploy/node_modules to runtime. This carries the
     compiled better-sqlite3.node binary without needing Python at runtime.

Author: SPCFXDA

apps/cas/backend/Dockerfile

@@ -14,6 +14,11 @@ FROM node:22-slim AS builder
 
 WORKDIR /app
 
+# Install build tools required by native modules (better-sqlite3 → node-gyp)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 make g++ \
+    && rm -rf /var/lib/apt/lists/*
+
 # Install pnpm
 RUN corepack enable && corepack prepare pnpm@10.11.0 --activate
 
@@ -28,6 +33,9 @@ COPY apps/cas/backend/ ./apps/cas/backend/
 
 RUN pnpm --filter @cfxdevkit/cas-backend build
 
+# Create a production-only flat bundle (includes compiled native bindings)
+RUN pnpm deploy --filter @cfxdevkit/cas-backend --prod /app/deploy
+
 # ── Stage 2: runtime ─────────────────────────────────────────────────────────
 FROM node:22-slim AS runtime
 
@@ -36,11 +44,10 @@ LABEL org.opencontainers.image.title="cas-backend" \
 
 WORKDIR /app
 
-# Only production deps
-COPY --from=builder /app/apps/cas/backend/package.json ./
-RUN npm install --omit=dev --ignore-scripts
-
+# Copy production node_modules from deploy bundle (includes compiled better-sqlite3)
+COPY --from=builder /app/deploy/node_modules ./node_modules
 COPY --from=builder /app/apps/cas/backend/dist ./dist
+COPY --from=builder /app/apps/cas/backend/package.json ./
 
 # Non-root user
 RUN addgroup --system cas && adduser --system --ingroup cas cas

apps/template/backend/Dockerfile

@@ -14,6 +14,11 @@ FROM node:22-slim AS builder
 
 WORKDIR /app
 
+# Install build tools required by native modules (better-sqlite3 → node-gyp)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 make g++ \
+    && rm -rf /var/lib/apt/lists/*
+
 # Install pnpm
 RUN corepack enable && corepack prepare pnpm@10.11.0 --activate
 
@@ -28,6 +33,9 @@ COPY apps/template/backend/ ./apps/template/backend/
 
 RUN pnpm --filter @cfxdevkit/template-backend build
 
+# Create a production-only flat bundle (includes compiled native bindings)
+RUN pnpm deploy --filter @cfxdevkit/template-backend --prod /app/deploy
+
 # ── Stage 2: runtime ─────────────────────────────────────────────────────────
 FROM node:22-slim AS runtime
 
@@ -36,11 +44,10 @@ LABEL org.opencontainers.image.title="template-backend" \
 
 WORKDIR /app
 
-# Only production deps
-COPY --from=builder /app/apps/template/backend/package.json ./
-RUN npm install --omit=dev --ignore-scripts
-
+# Copy production node_modules from deploy bundle (includes compiled better-sqlite3)
+COPY --from=builder /app/deploy/node_modules ./node_modules
 COPY --from=builder /app/apps/template/backend/dist ./dist
+COPY --from=builder /app/apps/template/backend/package.json ./
 
 # Non-root user
 RUN addgroup --system template && adduser --system --ingroup template template