fix: copy lockfile into Docker builder stage and use npm ci

The builder stages in both Dockerfiles copied only package.json, causing
npm install to resolve caret ranges to the latest compatible versions
rather than using the locked versions. This pulled better-auth 1.5.1
(which has breaking type changes) instead of the locked 1.4.9, failing
every PR's integration tests.

Copy package-lock.json alongside package.json and switch to npm ci for
deterministic, reproducible builds.

Author: jakebromberg

Dockerfile.auth

@@ -3,12 +3,12 @@ FROM node:22-alpine AS builder
 
 WORKDIR /auth-builder
 
-COPY ./package.json ./
+COPY ./package.json ./package-lock.json ./
 COPY ./tsconfig.base.json ./
 COPY ./shared ./shared
 COPY ./apps/auth ./apps/auth
 
-RUN npm install && npm run build --workspace=@wxyc/database --workspace=shared/** --workspace=@wxyc/auth-service
+RUN npm ci && npm run build --workspace=@wxyc/database --workspace=shared/** --workspace=@wxyc/auth-service
 
 #Production stage
 FROM node:22-alpine AS prod

Dockerfile.backend

@@ -3,12 +3,12 @@ FROM node:22-alpine AS builder
 
 WORKDIR /builder
 
-COPY ./package.json ./
+COPY ./package.json ./package-lock.json ./
 COPY ./tsconfig.base.json ./
 COPY ./shared ./shared
 COPY ./apps/backend ./apps/backend
 
-RUN npm install && npm run build --workspace=@wxyc/database --workspace=shared/** --workspace=@wxyc/backend
+RUN npm ci && npm run build --workspace=@wxyc/database --workspace=shared/** --workspace=@wxyc/backend
 
 #Production stage
 FROM node:22-alpine AS prod