deploy(taktik): add Dockerfile, docker-compose, SSO config

- Dockerfile based on sveltekit-base pattern (port 5027)
- docker-compose.macmini.yml: taktik-web service with auth + sync
- mana-auth: added taktik.mana.how to trustedOrigins
- CORS_ORIGINS: added taktik.mana.how

Remaining manual steps on Mac Mini:
- cloudflared tunnel route: taktik.mana.how -> localhost:5027
- ./scripts/mac-mini/build-app.sh taktik-web

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/taktik/apps/web/Dockerfile

@@ -0,0 +1,53 @@
+# syntax=docker/dockerfile:1
+# Build stage - inherits pre-built shared packages from sveltekit-base
+FROM sveltekit-base:local AS builder
+
+# Build arguments for SvelteKit static env vars
+ARG PUBLIC_MANA_CORE_AUTH_URL=http://mana-core-auth:3001
+
+# Set as environment variables for build
+ENV PUBLIC_MANA_CORE_AUTH_URL=$PUBLIC_MANA_CORE_AUTH_URL
+
+# Copy app-specific packages
+COPY apps/taktik/packages/shared ./apps/taktik/packages/shared
+COPY apps/taktik/apps/web ./apps/taktik/apps/web
+
+# Install app-specific dependencies
+RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
+    pnpm install --no-frozen-lockfile --ignore-scripts
+
+# Build the web app
+WORKDIR /app/apps/taktik/apps/web
+RUN pnpm exec svelte-kit sync
+RUN NODE_OPTIONS="--max-old-space-size=4096" pnpm build
+
+# Production stage
+FROM node:20-alpine AS production
+
+# Keep same directory structure as builder so pnpm symlinks resolve correctly
+WORKDIR /app/apps/taktik/apps/web
+
+# Copy the pnpm store that symlinks point to (at /app/node_modules/.pnpm)
+COPY --from=builder /app/node_modules/.pnpm /app/node_modules/.pnpm
+
+# Copy the app's node_modules (contains symlinks to the pnpm store)
+COPY --from=builder /app/apps/taktik/apps/web/node_modules ./node_modules
+
+# Copy built application
+COPY --from=builder /app/apps/taktik/apps/web/build ./build
+COPY --from=builder /app/apps/taktik/apps/web/package.json ./
+
+# Expose port
+EXPOSE 5027
+
+# Set environment variables
+ENV NODE_ENV=production
+ENV PORT=5027
+ENV HOST=0.0.0.0
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:5027/health || exit 1
+
+# Run the app
+CMD ["node", "build"]