fix: harden Linux Docker dependency verification

.github/workflows/docker-build.yml

@@ -0,0 +1,18 @@
+name: Linux Docker build
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build production image (linux/amd64)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build the Cloud Run image without deploying
+        run: docker build --pull --platform linux/amd64 --progress=plain --tag brewtify:ci .

Dockerfile

@@ -21,7 +21,14 @@ COPY projects/mini-app/public ./projects/mini-app/public/
 COPY projects/mini-app/dev ./projects/mini-app/dev/
 
 # Install all dependencies (including devDependencies for build)
-RUN npm ci --workspace=projects/api --workspace=projects/shared --workspace=projects/spotify --workspace=projects/tap --workspace=projects/mini-app --include-workspace-root
+# npm can silently skip failed optional downloads; verify native build tools early.
+RUN if npm ci --workspace=projects/api --workspace=projects/shared --workspace=projects/spotify --workspace=projects/tap --workspace=projects/mini-app --include-workspace-root --include=dev --include=optional --loglevel=verbose > /tmp/npm-ci.log 2>&1 \
+    && node --input-type=module -e "await import('rolldown'); await import('@tailwindcss/oxide'); await import('lightningcss'); await import('rollup');"; then \
+      rm /tmp/npm-ci.log; \
+    else \
+      cat /tmp/npm-ci.log; \
+      exit 1; \
+    fi
 
 # Build shared package
 WORKDIR /app/projects/shared

README.md

@@ -1,6 +1,25 @@
 # Brewtify
 Playlists Brewery for Spotify
 
+## Linux build verification
+
+The **Linux Docker build** pull-request check builds both stages of the production
+image without cloud credentials, publishing, or deployment. To run the same check
+locally with Docker:
+
+```bash
+docker build --pull --platform linux/amd64 --progress=plain --tag brewtify:ci .
+```
+
+The builder explicitly includes development and optional dependencies and loads
+the Rolldown, Tailwind Oxide, Lightning CSS, and Rollup native bindings before
+compilation. If installation or binding loading fails, it prints the captured
+verbose npm log before exiting. Check this log for skipped packages and download
+or installation failures. A "Cannot find native binding" error alone does not
+prove that the lockfile is missing platform
+entries. Preserve the committed dependency versions when investigating; do not
+delete and regenerate the lockfile or upgrade packages as a first response.
+
 ## Party Queue pilot
 
 The existing Telegram Mini App includes a feature-gated cross-service Party Queue.