fix: copy lockfile into Docker builder stage and use npm ci

[jakebromberg]

Summary

• The builder stages in Dockerfile.backend and Dockerfile.auth only copied package.json, not package-lock.json
• This caused npm install to resolve caret ranges to latest compatible versions instead of locked versions
• better-auth resolved to 1.5.1 (which has breaking type changes in Auth) instead of the locked 1.4.9, failing integration tests on every open PR
• Fix: copy package-lock.json into the builder stage and switch from npm install to npm ci for deterministic builds

Test plan

• Verified the change is limited to Dockerfile COPY and RUN lines
• CI integration tests should pass (this is the fix for the current failures on PRs feat: add account setup email and capabilities/JWT support #150, feat: add labels table and normalize label data #163, fix: return 410 Gone instead of 301 for deprecated registerDevice #172, fix: return 404 in changeOrder when entry doesn't exist #174, fix: return 201 Created for all resource creation endpoints #182, fix: standardize error response format to { message } across all endpoints #183)