feat(docker): modernize Docker setup with Bake-first workflow

[CybotTM]

Summary

• Introduce docker-bake.hcl as single source of truth for all build configuration (like package.json for JS)
• Modernize Dockerfile with multi-stage builds, non-root user, healthcheck
• Remove build sections from compose.yml (runtime-only now)
• Update Makefile to use docker bake for all builds
• Production image reduced from 1.15GB to 976MB (-15%)

Architecture

docker-bake.hcl    → All build config (versions, targets, tags, labels)
Dockerfile         → Build logic only (no version defaults)
compose.yml        → Runtime only (volumes, environment, ports)

New Commands

docker bake              # Build production image
docker bake app-dev      # Build development image
docker bake app-tools    # Build tools image
docker bake all          # Build all images
make up                  # Build + start (uses bake)

Breaking Changes

• Must use docker bake for builds, not docker build or docker compose build
• Target renamed: devbox → dev

Test plan

• docker bake all builds successfully
• make up starts dev environment
• Production image runs as non-root user
• Healthcheck works
• CI pipeline passes

[Copilot]

Pull request overview

This PR modernizes the Docker setup by introducing docker-bake.hcl as the single source of truth for build configuration, implementing multi-stage builds with security improvements, and reducing production image size by 15%.

Changes:

• Introduces docker-bake.hcl to centralize all build configuration (versions, targets, tags, labels)
• Modernizes Dockerfile with multi-stage builds, non-root production user, and healthcheck
• Removes build sections from compose.yml (now runtime-only configuration)
• Updates Makefile to use docker bake commands for all image builds
• Adds healthcheck script for PHP-FPM monitoring
• Updates all documentation to reflect new build workflow

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
docker-bake.hcl	New centralized build configuration with version definitions and build targets
Dockerfile	Multi-stage build with base, deps, tools, dev, and production stages; adds non-root user and healthcheck
compose.yml	Removed build sections; services now reference pre-built images
Makefile	Added bake targets (bake, bake-dev, bake-tools, bake-all); updated up/tools-up to build first
docker/php/healthcheck.sh	New healthcheck script for PHP-FPM process monitoring
docs/*.md	Updated all documentation to use docker bake commands and new workflow
.dockerignore	Expanded with better organization and more exclusions
.env.example	Updated BUILD_TARGET from 'devbox' to 'dev'
.envrc	Updated help text to reflect new bake commands
README.rst	Updated setup instructions for new build workflow
.github/copilot-instructions.md	Updated setup commands to use docker bake