Ristruttura il deploy: immagine autosufficiente per Dokploy

Il Dockerfile compilava l'applicazione in /app-src mentre il runtime girava
da /var/www/html, popolato solo dal bind mount del sorgente: l'immagine
costruita non veniva mai usata. L'entrypoint rieseguiva composer install e
npm run build a ogni avvio, dentro il container. Su Dokploy, senza sorgente
sull'host, questo significava build a runtime a ogni deploy.

Ora vendor/ e public/build sono compilati in stage separati e copiati
nell'immagine finale. I container di produzione non montano il sorgente e
non eseguono build all'avvio: un redeploy e' build, migrazioni, online.

- Dockerfile multi-stage (composer, node, runtime)
- nginx e php-fpm nello stesso container via supervisor: con container
  separati nginx avrebbe bisogno di una copia di public/ e del volume
  storage solo per servire file statici
- clear_env = no in www.conf, senza cui php-fpm nasconde a Laravel tutte
  le variabili d'ambiente
- configurazione da ambiente di processo invece di .env riscritto con sed;
  il compose fissa solo i valori dettati dalla topologia
- fail-fast su APP_URL, DB_PASSWORD, DB_ROOT_PASSWORD, REDIS_PASSWORD
- servizio scheduler dedicato: schedule:work non veniva mai eseguito,
  quindi la pulizia dell'audit log non e' mai partita
- solo il container app esegue le migrazioni, per evitare che due
  container in gara lascino uno schema applicato a meta'
- healthcheck separati per worker e scheduler, che non espongono HTTP
- docker-compose.dev.yml per lo sviluppo locale
- documentazione unificata in README.md e HANDOFF.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.dev.yml

@@ -0,0 +1,149 @@
+# =============================================================================
+# TerManager2 — local development
+#
+#   cp .env.example .env
+#   docker compose -f docker-compose.dev.yml up -d --build
+#   open http://localhost:8080     (Mailpit UI on http://localhost:8025)
+#
+# This is a standalone file, not an overlay: it bind-mounts the source so edits
+# apply without a rebuild, publishes ports to the host, and swaps the external
+# Traefik network for a local one. Production uses docker-compose.yml.
+# =============================================================================
+
+x-dev-env: &dev-env
+  APP_NAME: ${APP_NAME:-TerManager2}
+  APP_ENV: local
+  APP_DEBUG: "true"
+  APP_KEY: ${APP_KEY:-}
+  APP_URL: http://localhost:${APP_PORT:-8080}
+  APP_TIMEZONE: ${APP_TIMEZONE:-Europe/Rome}
+
+  DB_CONNECTION: mysql
+  DB_HOST: mariadb
+  DB_PORT: 3306
+  DB_DATABASE: ${DB_DATABASE:-termanager2}
+  DB_USERNAME: ${DB_USERNAME:-termanager2}
+  DB_PASSWORD: ${DB_PASSWORD:-secret}
+
+  REDIS_HOST: redis
+  REDIS_PORT: 6379
+  REDIS_PASSWORD: ${REDIS_PASSWORD:-redissecret}
+
+  CACHE_STORE: redis
+  SESSION_DRIVER: redis
+  SESSION_SECURE_COOKIE: "false"
+  QUEUE_CONNECTION: redis
+
+  LOG_CHANNEL: stderr
+  LOG_LEVEL: debug
+
+  MAIL_MAILER: smtp
+  MAIL_HOST: mailpit
+  MAIL_PORT: 1025
+  MAIL_FROM_ADDRESS: noreply@termanager2.local
+  MAIL_FROM_NAME: TerManager2
+
+services:
+  app:
+    build:
+      context: .
+      dockerfile: docker/php/Dockerfile
+    restart: unless-stopped
+    ports:
+      - "${APP_PORT:-8080}:80"
+    environment:
+      <<: *dev-env
+      # Pick up source edits without restarting php-fpm.
+      PHP_OPCACHE_VALIDATE_TIMESTAMPS: 1
+      RUN_DB_SEED_ON_FIRST_START: "true"
+      SEED_DEV_DATA: ${SEED_DEV_DATA:-false}
+      INITIAL_ADMIN_NAME: ${INITIAL_ADMIN_NAME:-Amministratore}
+      INITIAL_ADMIN_EMAIL: ${INITIAL_ADMIN_EMAIL:-admin@termanager2.local}
+      INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD:-password}
+    volumes:
+      # Source is bind-mounted for live edits. vendor/ and public/build stay as
+      # anonymous volumes so the host (which has neither) doesn't mask what the
+      # image built.
+      - ./:/var/www/html
+      - /var/www/html/vendor
+      - /var/www/html/public/build
+    networks:
+      - termanager2
+    depends_on:
+      mariadb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  queue-worker:
+    build:
+      context: .
+      dockerfile: docker/php/Dockerfile
+    restart: unless-stopped
+    environment:
+      <<: *dev-env
+      PHP_OPCACHE_VALIDATE_TIMESTAMPS: 1
+    volumes:
+      - ./:/var/www/html
+      - /var/www/html/vendor
+      - /var/www/html/public/build
+    networks:
+      - termanager2
+    depends_on:
+      app:
+        condition: service_healthy
+    entrypoint: ["queue-entrypoint.sh"]
+    command: ["php", "artisan", "queue:work", "redis", "--queue=default", "--sleep=3", "--tries=1", "--timeout=600"]
+
+  mariadb:
+    image: mariadb:11
+    restart: unless-stopped
+    environment:
+      MARIADB_DATABASE: ${DB_DATABASE:-termanager2}
+      MARIADB_USER: ${DB_USERNAME:-termanager2}
+      MARIADB_PASSWORD: ${DB_PASSWORD:-secret}
+      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-rootsecret}
+    ports:
+      # Exposed locally so you can attach a GUI client. Never in production.
+      - "${DB_PORT_HOST:-3306}:3306"
+    volumes:
+      - db_data_dev:/var/lib/mysql
+    networks:
+      - termanager2
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD:-redissecret}"]
+    volumes:
+      - redis_data_dev:/data
+    networks:
+      - termanager2
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -a '${REDIS_PASSWORD:-redissecret}' ping | grep -q PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  mailpit:
+    image: axllent/mailpit:latest
+    restart: unless-stopped
+    ports:
+      - "${MAIL_PORT:-1025}:1025"
+      - "${MAILPIT_UI_PORT:-8025}:8025"
+    networks:
+      - termanager2
+
+volumes:
+  db_data_dev:
+  redis_data_dev:
+
+networks:
+  termanager2:
+    driver: bridge