Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="Dockerfile" line_range="10-19" />
<code_context>

-# ExifTool requires Perl, which is not included in Alpine by default
-RUN apk add --no-cache perl
+COPY package.json package-lock.json ./
+RUN npm ci

-# Create a non-root user to run the process
-RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+COPY . .
+RUN npm run build

+FROM node:18-bookworm-slim AS runtime
+ENV NODE_ENV=production
 WORKDIR /app

-# Install dependencies first so Docker can cache this layer
-COPY package*.json ./
-RUN npm ci --omit=dev
+# exiftool-vendored requires Perl at runtime
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends perl \
+  && rm -rf /var/lib/apt/lists/*
+
+# Create non-root user
+RUN groupadd --system appgroup && useradd --system --gid appgroup appuser
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev \
+  && npm cache clean --force

</code_context>
<issue_to_address>
**suggestion (performance):** Consider reusing node_modules from the builder stage to avoid a second full npm install

Dependencies are currently installed twice (`npm ci` in the builder and `npm ci --omit=dev` in the runtime). To reduce build time and network usage, you could copy `node_modules` from the builder into the runtime image and then run `npm prune --production` (or equivalent) there, preserving the multi-stage setup without a second full install.

Suggested implementation:

```
# SpectraCleanse AI – Production Dockerfile (builds frontend + backend runtime)
# ─────────────────────────────────────────────────────────────────────────────

FROM node:18-bookworm-slim AS builder
WORKDIR /app

# Install full dependency tree (including devDependencies) for build
COPY package.json package-lock.json ./
RUN npm ci

# Copy source and build
COPY . .
RUN npm run build

```

To fully implement reusing `node_modules` from the builder in the runtime image, you should also:

1. In the `runtime` stage (the `FROM node:18-bookworm-slim AS runtime` section), replace the second `npm ci --omit=dev` with copying `node_modules` from the builder and pruning dev dependencies, e.g.:

   ```dockerfile
   # Instead of:
   COPY package.json package-lock.json ./
   RUN npm ci --omit=dev \
     && npm cache clean --force

   # Use:
   COPY package.json package-lock.json ./
   COPY --from=builder /app/node_modules ./node_modules

   RUN npm prune --production \
     && npm cache clean --force
   ```

2. Ensure you copy the built artifacts from the builder into the runtime image (if not already present), for example:

   ```dockerfile
   COPY --from=builder /app/dist ./dist
   ```

3. Keep the existing Perl installation and non-root user setup in the runtime stage as-is, so that `exiftool-vendored` continues to work and the container still runs as `appuser`.

Adjust paths like `/app/dist` or the final `CMD` to match your existing build output and startup command.
</issue_to_address>

### Comment 2
<location path="README.md" line_range="81" />
<code_context>
+### Required production environment variables
+
+- `NODE_ENV=production`
+- `JWT_SECRET`
+- `STRIPE_SECRET_KEY`
+- `STRIPE_WEBHOOK_SECRET`
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Clarify that `JWT_SECRET` should be a strong, unique secret in production.

Add a brief note to this bullet that `JWT_SECRET` must be a strong, unique value and not reused across environments to avoid weak production configurations.

```suggestion
- `JWT_SECRET` – a strong, unique secret value; **do not** reuse across environments (e.g., dev/staging/production)
```
</issue_to_address>