fix: restore Node deployment and keep Go on its branch

Dockerfile

@@ -1,29 +1,42 @@
 # syntax=docker/dockerfile:1.7
-FROM node:24-slim AS assets
+
+# Stage 1: install all deps (with cache mount so npm cache survives across builds)
+FROM node:22-slim AS deps
 WORKDIR /app
-COPY package.json package-lock.json gulpfile.js ./
-RUN --mount=type=cache,target=/root/.npm npm ci --no-audit --fund=false
+COPY package.json package-lock.json ./
+RUN --mount=type=cache,id=npm-all,target=/root/.npm,sharing=locked \
+    npm ci --prefer-offline --no-audit --fund=false
+
+# Stage 2: build TypeScript + gulp assets. Source changes only invalidate from here.
+FROM node:22-slim AS build
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY package.json package-lock.json tsconfig.json gulpfile.js ./
 COPY public ./public
 COPY src ./src
-RUN npm run build:ui
+RUN npm run build
 
-FROM golang:1.27.3-bookworm AS build
-WORKDIR /src
-COPY backend/go.mod backend/go.sum ./
-RUN --mount=type=cache,target=/go/pkg/mod go mod download
-COPY backend ./
-RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /anonymous-server ./cmd/server
-
-FROM debian:bookworm-slim
-LABEL science.4open.owner-alert-protocol="recipient-v2"
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/* && useradd --uid 10001 --create-home anonymous
+# Stage 3: install production deps on the runtime's libc. Native optional
+# dependencies such as zstd must select musl binaries for the Alpine runtime.
+FROM node:22-alpine AS prod-deps
 WORKDIR /app
-COPY --from=build /anonymous-server /usr/local/bin/anonymous-server
-COPY --from=build /src/licenses /usr/share/licenses/anonymous-github
-COPY --from=assets --chown=10001:10001 /app/public ./public
-RUN mkdir /app/repositories && chown 10001:10001 /app/repositories
-USER 10001:10001
-ENV PORT=5000 PUBLIC_DIR=/app/public FOLDER=/app/repositories COOKIE_SECURE=true GOMEMLIMIT=768MiB
-HEALTHCHECK --interval=30s --timeout=5s --start-period=20s CMD ["/usr/local/bin/anonymous-server", "healthcheck"]
+COPY package.json package-lock.json ./
+RUN --mount=type=cache,id=npm-prod,target=/root/.npm,sharing=locked \
+    npm ci --omit=dev --prefer-offline --no-audit --fund=false
+
+# Stage 4: minimal runtime
+FROM node:22-alpine AS runtime
+LABEL science.4open.owner-alert-protocol="recipient-v2"
+ENV NODE_ENV=production
+ENV PORT=5000
 EXPOSE 5000
-ENTRYPOINT ["/usr/local/bin/anonymous-server"]
+WORKDIR /app
+
+COPY --from=prod-deps /app/node_modules ./node_modules
+RUN node -e "const assert = require('node:assert/strict'); const zstd = require('@mongodb-js/zstd'); (async () => { const input = Buffer.from('native compression smoke test'); const compressed = await zstd.compress(input, 3); assert.deepEqual(await zstd.decompress(compressed), input); })().catch(error => { console.error(error); process.exit(1); });"
+COPY --from=build /app/build ./build
+COPY --from=build /app/public ./public
+COPY package.json ./package.json
+COPY healthcheck.js ./healthcheck.js
+
+CMD ["node", "--max-old-space-size=2048", "./build/server/index.js"]