fix(dockerfile): rehab pc2-node/Dockerfile for bugs 2-5 caught by docker-smoke

Three surgical fixes to pc2-node/Dockerfile, all targeting bugs that
docker-smoke (added 2026-05-18 in CI-HARDENING-A4-D1) caught on its
first 2 runs:

BUG 2 (BOOT-BLOCKING): Config copy path wrong
  Was: COPY --from=builder /app/config ./config
  Now: COPY --from=builder /app/pc2-node/config ./config

  loader.ts:139 computes DEFAULT_CONFIG_PATH = __dirname/../../config/default.json
  which resolves to /app/config/default.json at runtime. The previous
  path was copying from the host repo-root /config/ which only contains
  pc2.json.example + pc2.production.json — NO default.json. The actual
  file lives at pc2-node/config/default.json. Container exited with
  "Default config not found" on every previous run.

BUG 3: WASM apps never copied to production image
  Added: COPY --from=builder /app/pc2-node/wasm-apps ./wasm-apps

  7 .wasm binaries (cenc-decrypt, cenc-encrypt, ddrm-renderer,
  mp4-split, ipfs-assemble, evm-multicall, amm-engine) are committed
  to the repo as pre-built artifacts but never made it into the
  production image. Result: dDRM + media segmentation + AMM all
  silently fall back to inferior paths.

  We do NOT run build-wasm.sh in Dockerfile — requires Rust+cargo+
  wasm-opt (~200MB build-stage bloat) for binaries already committed.

BUGS 4+5: sharp + @napi-rs/canvas native bindings missing
  Added after npm ci:
    RUN cd pc2-node && npm install --no-save --include=optional \
        sharp @napi-rs/canvas

  Classic npm/cli#4828: pc2-node/package-lock.json was generated on
  macOS-arm64 (lead dev environment), so it only records
  @img/sharp-darwin-arm64 and @napi-rs/canvas-darwin-arm64. When
  npm ci runs on alpine/linux/musl/x64 in the Dockerfile builder, it
  strictly follows the lockfile and silently skips the linux variants
  that aren't recorded there.

  Fix: after npm ci, force a non-lockfile install with --include=optional
  --no-save which triggers each package's install/check.js hook to
  detect alpine/linux/musl/x64 and download the correct prebuilts
  (@img/sharp-linuxmusl-x64 + libvips sibling,
  @napi-rs/canvas-linux-x64-musl). --no-save means we don't modify
  package.json or the lockfile.

  Note: legacy canvas@2.x left as graceful-degradation fallback (already
  in optionalDependencies, codebase has fallback logic). Migrating to
  @napi-rs/canvas everywhere is Phase 2 source-code work, separate ticket.

VALIDATION:
- All 7 .wasm files confirmed tracked in git (git ls-files)
- default.json + config.json + models-catalog.json confirmed at
  pc2-node/config/ (correct location for COPY)
- .dockerignore only excludes Dockerfile/.dockerignore/node_modules/puter —
  wasm-apps + config will be in build context

See .cursor/tasks/RELEASE-ENGINEERING-V1280/DOCKERFILE-REHAB-V1280.md for
full diagnoses and acceptance criteria.

Aims to take docker-smoke from experimental-red to first green run.
Need 3 consecutive green runs to promote to required gate.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: SashaMIT

.cursor/tasks/RELEASE-ENGINEERING-V1280/DOCKERFILE-REHAB-V1280.md

@@ -0,0 +1,135 @@
+# Task: DOCKERFILE-REHAB-V1280 — fix 4 Dockerfile bugs caught by docker-smoke
+
+**Task ID**: `DOCKERFILE-REHAB-V1280`
+**Created**: 2026-05-18
+**Status**: **InProgress** — executing in same session as CI-HARDENING-A4-D1
+**Priority**: Medium (Docker deployment shape only; does not block Mac launcher)
+**Predecessor**: `CI-HARDENING-A4-D1` (added the docker-smoke job that surfaced these bugs)
+
+---
+
+## Why this exists
+
+The docker-smoke CI job introduced 2026-05-18 by `CI-HARDENING-A4-D1` caught 4 Dockerfile bugs that would hit every supernode operator running `docker build -t pc2-node . -f pc2-node/Dockerfile && docker run pc2-node` from current `main`. Bug 1 was fixed in `CI-HARDENING-A4-D1` (Go 1.22→1.24). This ticket addresses bugs 2-5.
+
+## Bug catalog with diagnoses
+
+### Bug 2: Config file copy path is wrong (BOOT-BLOCKING)
+
+**Symptom** (from CI log):
+```
+[ERROR] ❌ Failed to load configuration: Error: Default config not found: /app/config/default.json
+    at loadDefaultConfig (/app/src/config/loader.ts:147:15)
+[PC2] exit code=1
+```
+
+**Root cause**: 
+- `pc2-node/src/config/loader.ts:139` defines `DEFAULT_CONFIG_PATH = join(__dirname, '../../config/default.json')`, so at runtime with `__dirname = /app/src/config`, the loader expects `/app/config/default.json`.
+- The Dockerfile line 119 copies from the WRONG location: `COPY --from=builder /app/config ./config` — this is the BUILDER's `/app/config/`, which after `COPY . .` (line 77) is the host's repo-root `/config/` directory. That directory only contains `pc2.json.example` and `pc2.production.json` — NO `default.json`.
+- The actual `default.json` file lives at `pc2-node/config/default.json` (host) → `/app/pc2-node/config/default.json` (builder).
+
+**Fix**: Change `COPY --from=builder /app/config ./config` → `COPY --from=builder /app/pc2-node/config ./config`.
+
+**Severity**: Boot-blocking. This is why every docker-smoke run was failing to reach healthy.
+
+---
+
+### Bug 3: WASM apps not copied to production image
+
+**Symptom** (from CI log):
+```
+[WARN] [DASHPackager] WASM preload skipped: cenc-encrypt WASM not found
+[WARN] [media-api] mp4-split WASM preload skipped
+[WARN] [media-api] WASM preload skipped: CENC decrypt WASM not found
+```
+
+**Root cause**: 
+- The 7 `.wasm` binaries ARE committed to git at `pc2-node/wasm-apps/*/*.wasm` (8MB total across cenc-decrypt, cenc-encrypt, ddrm-renderer, mp4-split, ipfs-assemble, evm-multicall, amm-engine).
+- The Dockerfile never copies them to the production image. Net result: dDRM features (encrypt/decrypt), media segmentation (mp4-split), and AMM operations all fall back to inferior paths or fail.
+
+**Fix**: Add `COPY --from=builder /app/pc2-node/wasm-apps ./wasm-apps` in the production stage.
+
+**Severity**: Functional degradation (warnings + fallback paths used). Not boot-blocking — server still starts.
+
+**Note**: We do NOT run `pc2-node/scripts/build-wasm.sh` in the Dockerfile because that requires Rust toolchain + cargo + wasm-opt (binaryen) which would add ~200MB to the build stage. Since `.wasm` files are committed to the repo as pre-built artifacts, copying is the right pattern.
+
+---
+
+### Bug 4: `sharp` native binding not found in production stage
+
+**Symptom** (from CI log):
+```
+[ERROR] [Thumbnail] ❌ Sharp failed to load - image thumbnails will be disabled
+[ERROR] [Thumbnail] This is a required dependency. Please reinstall: npm install
+```
+
+**Root cause**: classic `npm/cli#4828`. The `pc2-node/package-lock.json` was generated on macOS-arm64 (Sasha's dev machine), so it ONLY contains:
+- `@img/sharp-darwin-arm64`
+- `@img/sharp-libvips-darwin-arm64`
+
+NO linux/musl variants are recorded in the lockfile. When `npm ci` runs on alpine/linux in the Dockerfile builder stage, it strictly follows the lockfile and silently skips the linux variants. Sharp's runtime probe then fails to find a native binding for the current platform.
+
+This is a well-known npm bug: https://github.com/npm/cli/issues/4828
+
+**Fix**: After `npm ci`, force-install platform-specific variants with `--include=optional`:
+```dockerfile
+RUN cd pc2-node && npm install --no-save --include=optional sharp
+```
+
+`--no-save` means don't modify `package.json` or `package-lock.json`. The install runs sharp's `install/check.js` post-install hook which detects the current platform (alpine/linux/musl/x64) and downloads the right `@img/sharp-linuxmusl-x64` + `@img/sharp-libvips-linuxmusl-x64` prebuilt binaries.
+
+**Severity**: Functional degradation (image thumbnails disabled). Not boot-blocking — fallback paths exist.
+
+---
+
+### Bug 5: `@napi-rs/canvas` native binding not found
+
+**Symptom** (from CI log):
+```
+Warning: Cannot load "@napi-rs/canvas" package: "Error: Cannot find native binding..."
+Warning: Cannot polyfill `DOMMatrix`, rendering may be broken.
+[WARN] [Thumbnail] ⚠️  Canvas not available - PDF/text thumbnails will be disabled
+```
+
+**Root cause**: Same `npm/cli#4828` bug as #4. Lockfile only has `@napi-rs/canvas-darwin-arm64`, no `@napi-rs/canvas-linux-x64-musl` variant.
+
+**Fix**: Same pattern — force-install with `--include=optional`:
+```dockerfile
+RUN cd pc2-node && npm install --no-save --include=optional @napi-rs/canvas
+```
+
+**Severity**: Functional degradation (PDF/text thumbnails disabled). Not boot-blocking.
+
+**Note**: Legacy `canvas@2.x` is also a fallback target listed in `optionalDependencies`. It needs Cairo/Pango system deps for alpine build-from-source, which would add ~50MB to the image. Since `@napi-rs/canvas` (prebuilt-only) supersedes it, we DO NOT add Cairo/Pango. The Thumbnail service already has graceful degradation when neither canvas variant loads — log shows "PDF.js loaded ✅" as primary path.
+
+---
+
+## Implementation plan
+
+Three Dockerfile changes, all in `pc2-node/Dockerfile`:
+
+1. **After `RUN cd pc2-node && npm ci --include=dev`** (around line 74): Add new RUN step that force-installs sharp + @napi-rs/canvas with `--include=optional` to fix bugs 4 + 5 (npm/cli#4828 workaround).
+
+2. **Replace `COPY --from=builder /app/config ./config`** (line 119) with `COPY --from=builder /app/pc2-node/config ./config` to fix bug 2.
+
+3. **Add new COPY** for `wasm-apps` to fix bug 3.
+
+All changes are inline-documented with the specific bug class and CI evidence.
+
+## Acceptance criteria
+
+- [ ] `pc2-node/Dockerfile` modified per implementation plan
+- [ ] CI docker-smoke job reaches `healthy` HEALTHCHECK state
+- [ ] No `[ERROR]` lines in the container boot log (warnings about legacy `canvas@2.x` are acceptable)
+- [ ] `/api/health` responds with `status: "ok"` from outside the container via port mapping
+- [ ] Updated `.cursor/tasks/RELEASE-ENGINEERING-V1280/CI-HARDENING-A4-D1.md` to mark bugs 2-5 as RESOLVED with reference to this ticket
+
+## What this is NOT
+
+- NOT promoting docker-smoke to a required gate. That requires 3 consecutive green runs and is tracked separately.
+- NOT re-enabling `pc2-node-docker.yml` publish-to-GHCR workflow. That's a deferred decision pending supernode operator audience growth.
+- NOT migrating canvas@2.x → @napi-rs/canvas in source code. That's Phase 2 work tracked in OPTIMISATION-AND-REFACTORING-2026-05.
+
+## Execution log
+
+(To be filled in during execution.)

pc2-node/Dockerfile

@@ -80,6 +80,29 @@ COPY pc2-node/package*.json ./pc2-node/
 # Install dependencies
 RUN cd pc2-node && npm ci --include=dev
 
+# npm/cli#4828 workaround: the pc2-node/package-lock.json is typically
+# generated on macOS-arm64 (the lead dev environment), so it ONLY records
+# the macOS platform variants of native deps:
+#   - @img/sharp-darwin-arm64 (sharp's native binding)
+#   - @napi-rs/canvas-darwin-arm64
+# When `npm ci` runs in this alpine/linux/musl/x64 builder, it strictly
+# follows the lockfile and silently skips the linux/musl variants that
+# aren't recorded there. Runtime then logs "Cannot find native binding"
+# for both sharp and @napi-rs/canvas.
+#
+# Fix: after `npm ci`, force-install the platform-specific variants with
+# `--include=optional --no-save`. This triggers each package's own
+# install/check.js post-install hook which detects alpine/linux/musl/x64
+# and downloads the correct prebuilts (@img/sharp-linuxmusl-x64,
+# @napi-rs/canvas-linux-x64-musl, plus their libvips siblings). --no-save
+# means we DON'T modify package.json or the lockfile — purely a runtime
+# fix-up for this Docker build's environment.
+#
+# Caught 2026-05-18 by docker-smoke CI on first run. See:
+#   - https://github.com/npm/cli/issues/4828 (the upstream npm bug)
+#   - .cursor/tasks/RELEASE-ENGINEERING-V1280/DOCKERFILE-REHAB-V1280.md
+RUN cd pc2-node && npm install --no-save --include=optional sharp @napi-rs/canvas
+
 # Copy source code
 COPY . .
 
@@ -122,8 +145,29 @@ COPY --from=builder /app/pc2-node/frontend ./frontend
 COPY --from=builder /app/pc2-node/package.json ./
 COPY --from=builder /app/pc2-node/tsconfig.json ./
 
-# Copy configuration templates
-COPY --from=builder /app/config ./config
+# Copy configuration templates.
+# Bug 2 fix (2026-05-18 docker-smoke): The previous path `/app/config` was
+# the host's repo-root /config/ directory which only contains
+# pc2.json.example + pc2.production.json — NO default.json. The actual
+# default config lives at pc2-node/config/default.json. The runtime
+# loader (pc2-node/src/config/loader.ts:139) computes
+# DEFAULT_CONFIG_PATH = join(__dirname, '../../config/default.json')
+# which resolves to /app/config/default.json at runtime (since
+# __dirname = /app/src/config). Copying pc2-node/config to /app/config
+# satisfies that path.
+COPY --from=builder /app/pc2-node/config ./config
+
+# Copy pre-built WASM apps.
+# Bug 3 fix (2026-05-18 docker-smoke): The 7 .wasm binaries (cenc-decrypt,
+# cenc-encrypt, ddrm-renderer, mp4-split, ipfs-assemble, evm-multicall,
+# amm-engine) are committed to the repo at pc2-node/wasm-apps/ as
+# pre-built artifacts. Without this copy, dDRM features, media
+# segmentation, and AMM operations all fall back to inferior paths or
+# fail outright with "WASM not found — run scripts/build-wasm.sh".
+# We do NOT build WASM in the Dockerfile because that requires the Rust
+# toolchain + cargo + wasm-opt (binaryen), ~200MB of build-stage bloat
+# for artifacts that are already committed.
+COPY --from=builder /app/pc2-node/wasm-apps ./wasm-apps
 
 # Copy entrypoint script
 COPY --from=builder /app/pc2-node/scripts/docker-entrypoint.sh /app/docker-entrypoint.sh