build: esmole Dockerfile

Build from repo root so @dbmole/core resolves; tsup bundles core into
dist while undici/MCP SDK/zod/ssh2 ship as pruned node_modules.

Mark ssh2 external in tsup: it is pulled in transitively by the bundled
core and ships an optional native crypto addon (pure-JS fallback). Inlining
would force esbuild to resolve a .node binary that need not exist on the
target; node-gyp also cannot reliably build it on alpine. Externalizing lets
ssh2 resolve from node_modules at runtime.

npm nests undici under packages/esmole-mcp/node_modules, so the runtime
stage copies both the root and the per-package node_modules.

packages/esmole-mcp/Dockerfile

@@ -0,0 +1,27 @@
+# build stage — install the whole workspace so @dbmole/core resolves, build esmole
+FROM node:22-alpine AS build
+WORKDIR /repo
+COPY package.json package-lock.json tsconfig.base.json ./
+COPY packages/core/package.json packages/core/
+COPY packages/dbmole-mcp/package.json packages/dbmole-mcp/
+COPY packages/esmole-mcp/package.json packages/esmole-mcp/
+RUN npm ci
+COPY packages/core packages/core
+COPY packages/esmole-mcp packages/esmole-mcp
+# tsup bundles @dbmole/core into dist (noExternal); the remaining runtime deps
+# (undici, MCP SDK, zod, ssh2) stay external and are served from node_modules.
+RUN npm run build --workspace esmole-mcp && npm prune --omit=dev
+
+# runtime stage — dist (core bundled in) + pruned production node_modules
+FROM node:22-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+# Root hoists most prod deps (MCP SDK, zod, ssh2); npm nests a few per-package
+# (undici). Copy both so every external the bundle requires resolves under
+# /app/node_modules at runtime.
+COPY --from=build /repo/node_modules ./node_modules
+COPY --from=build /repo/packages/esmole-mcp/node_modules ./node_modules
+COPY --from=build /repo/packages/esmole-mcp/dist ./dist
+RUN mkdir -p /home/node/.config/esmole && chown -R node:node /home/node/.config
+USER node
+ENTRYPOINT ["node", "dist/index.js"]