fix(ci): replace turbo-pruned lockfile with full root lockfile to fix @heroui/react missing in Docker

turbo prune cannot fully parse the npm 11 lockfile format, causing it to
generate an incomplete out/package-lock.json that drops non-hoisted workspace
entries (apps/storefront/node_modules/@heroui/react and related packages).
Replacing it with the full root lockfile ensures npm ci in the Docker deps
stage installs all packages including non-hoisted ones.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/deploy-staging.yml

@@ -88,6 +88,11 @@ jobs:
           # "Module not found: convex/_generated/api" at build time.
           # Copy it manually so the Dockerfile has the generated types it needs.
           cp -r convex out/full/convex
+          # turbo prune cannot fully parse the npm 11 lockfile format, so it generates
+          # an incomplete out/package-lock.json that omits non-hoisted workspace entries
+          # (e.g. apps/storefront/node_modules/@heroui/react). Replace it with the full
+          # root lockfile so that npm ci in Docker installs every package correctly.
+          cp package-lock.json out/package-lock.json
 
       - name: Authenticate with registry
         # docker login sends HTTPS even for HTTP-only (insecure) registries, so it

apps/storefront/Dockerfile

@@ -30,7 +30,12 @@ FROM node:20-alpine AS builder
 
 WORKDIR /app
 
-COPY --from=deps /app/node_modules ./node_modules
+# Copy everything from the deps stage — not just /app/node_modules.
+# @heroui/react cannot be hoisted to the root by npm and is installed at
+# apps/storefront/node_modules/ instead. Copying only the root node_modules
+# would leave it missing. Copying all of /app/ brings both root and
+# workspace-level node_modules, then full/ layers the source on top.
+COPY --from=deps /app/ ./
 COPY full/ .
 
 # NEXT_PUBLIC_* vars are baked into the client bundle at build time by Next.js.