Slim the Docker image and clean up after every deploy

- Build Next.js as a standalone server and copy only that into the
  runtime image, instead of the whole node_modules tree
- Mark three dynamic file reads with turbopackIgnore so the standalone
  trace does not pull in the entire project
- Deploy workflow prunes unused images and build cache older than a day
  at the start and end of every run, including failed ones, and logs
  disk usage before building

Failed builds were leaving their layers behind until the server's disk
filled, which broke the deploy, the database and Gitea sign-in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/api/transcoder/upload/[videoId]/route.ts

@@ -57,7 +57,7 @@ export async function POST(
 
   // Security: path traversal guard.
   for (const p of [tempZipPath, tempDir, finalDir]) {
-    if (!path.resolve(p).startsWith(path.resolve(HLS_ROOT))) {
+    if (!path.resolve(/*turbopackIgnore: true*/ p).startsWith(path.resolve(HLS_ROOT))) {
       return NextResponse.json({ error: "Forbidden" }, { status: 403 });
     }
   }

app/uploads/videos/[...path]/route.ts

@@ -148,7 +148,10 @@ export async function GET(
     }
 
     if (range) {
-      const stream = fs.createReadStream(filePath, { start: range.start, end: range.end });
+      const stream = fs.createReadStream(/*turbopackIgnore: true*/ filePath, {
+        start: range.start,
+        end: range.end,
+      });
       return new NextResponse(Readable.toWeb(stream) as unknown as BodyInit, {
         status: 206,
         headers: {
@@ -159,7 +162,7 @@ export async function GET(
       });
     }
 
-    const stream = fs.createReadStream(filePath);
+    const stream = fs.createReadStream(/*turbopackIgnore: true*/ filePath);
     return new NextResponse(Readable.toWeb(stream) as unknown as BodyInit, {
       status: 200,
       headers: { ...headers, "Content-Length": String(stats.size) },