build: compile canvas without external binary download

Dockerfile

@@ -25,7 +25,7 @@ RUN --mount=type=cache,target=/root/.npm \
     lock_sha="$(sha256sum package-lock.json | awk '{print $1}')" && \
     echo "Installing dependencies (using cache if available)..." && \
     npm config set registry https://registry.npmmirror.com && \
-    npm ci --prefer-offline --no-audit --no-fund --legacy-peer-deps && \
+    npm_config_build_from_source=canvas npm ci --prefer-offline --no-audit --no-fund --legacy-peer-deps && \
     test "$manifest_sha" = "$(sha256sum package.json | awk '{print $1}')" && \
     test "$lock_sha" = "$(sha256sum package-lock.json | awk '{print $1}')" && \
     node -e "const sharp=require('sharp'); sharp(Buffer.alloc(4),{raw:{width:1,height:1,channels:4}}).png().toBuffer().then(()=>console.log('sharp dependency smoke passed')).catch((error)=>{console.error(error);process.exit(1)})" && \

lib/__tests__/video-transcode-deploy-drain.test.ts

@@ -467,6 +467,7 @@ describe('production video transcode drain gate', () => {
     const finalMigrationInclude = dockerignore.lastIndexOf('!prisma/migrations/**')
 
     expect(dockerfile).toContain('npm ci --prefer-offline')
+    expect(dockerfile).toContain('npm_config_build_from_source=canvas npm ci')
     expect(dockerfile).not.toContain('--omit=optional')
     expect(dockerfile).toContain("grep -Eq '^[0-9a-f]{40}$'")
     expect(dockerfile).toContain("const sharp=require('sharp')")

scripts/safe-production-migrate.test.mjs

@@ -427,6 +427,7 @@ test('container supply chain and migrator image are immutable while SOP keeps co
   )
   assert.match(deps, /^COPY package\.json package-lock\.json \.\/$/m)
   assert.match(deps, /npm ci --prefer-offline --no-audit --no-fund --legacy-peer-deps/)
+  assert.match(deps, /npm_config_build_from_source=canvas npm ci/)
   assert.doesNotMatch(deps, /--omit=optional/)
   assert.match(deps, /const sharp=require\('sharp'\)/)
   assert.doesNotMatch(deps, /\bnpm install\b|writeFileSync|delete pkg\.optionalDependencies/)