Coastal Timesheet v2 — full feature buildout

Features:
- Copy Previous Week (entries duplication)
- Bulk Approve/Reject (admin workflow)
- Overtime tracking (employee + admin views)
- DayCard component with auto-save
- PDF generation, email notifications
- React + Tailwind frontend, Prisma + PostgreSQL backend
- Docker deployment (3 containers)

docker/backend/Dockerfile

@@ -0,0 +1,55 @@
+# ───────────────────────────────────────────────────
+# Coastal Timesheet — Backend Dockerfile
+# Node 22 Alpine · Prisma · Express
+# ───────────────────────────────────────────────────
+
+# ── Stage 1: Install dependencies ──────────────────
+FROM node:22-alpine AS deps
+
+WORKDIR /app
+
+# Copy package files
+COPY backend/package.json backend/package-lock.json* ./
+
+# Install production dependencies
+RUN npm ci --omit=dev 2>/dev/null || npm install --omit=dev
+
+# ── Stage 2: Build (generate Prisma client) ────────
+FROM node:22-alpine AS builder
+
+WORKDIR /app
+
+# Copy deps from previous stage
+COPY --from=deps /app/node_modules ./node_modules
+COPY backend/ ./
+
+# Generate Prisma client
+RUN npx prisma generate
+
+# ── Stage 3: Production image ─────────────────────
+FROM node:22-alpine AS runner
+
+WORKDIR /app
+
+# Add non-root user for security
+RUN addgroup --system --gid 1001 coastal && \
+    adduser --system --uid 1001 coastal
+
+# Copy application
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/prisma ./prisma
+COPY --from=builder /app/src ./src
+COPY --from=builder /app/package.json ./
+
+# Switch to non-root user
+USER coastal
+
+# Expose port
+EXPOSE 3001
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+    CMD node -e "fetch('http://localhost:3001/api/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"
+
+# Start with migration and seed on first run
+CMD ["sh", "-c", "npx prisma db push --accept-data-loss 2>/dev/null; node prisma/seed.js 2>/dev/null; node src/index.js"]