Telemetry Tracker v1.18.5

Reproducible API builds from pnpm-lock.yaml (new apps/api/Dockerfile, pnpm --frozen-lockfile) and lockfile security alignment: fastify 5.12.5, find-my-way 9.9.0, fast-uri 3.1.8/4.2.1, Prisma 6.19.3 (#759). No migrations, no env var changes. Self-hosters: build the API with docker build -f apps/api/Dockerfile . from the repo root.

Upgrade notes for Railway self-hosters

v1.18.5 adds apps/api/Dockerfile. Railway automatically builds with a Dockerfile found in a service's Root Directory, even when the builder is Railpack. If your API, retention cron, alert-rules evaluator or alert webhook worker still uses Root Directory apps/api, the build fails with "/apps/api": not found. Your previous deployment keeps running, but the update won't ship.

For each of those services:

1. Set Root Directory to empty (repo root).
2. Set Builder to Dockerfile with path apps/api/Dockerfile, and add the variable RAILWAY_DOCKERFILE_PATH=apps/api/Dockerfile.
3. Set Watch Paths to /apps/api/**, /pnpm-lock.yaml and /package.json.
4. Keep start commands as they are (empty for the API; node dist/jobs/… for crons/workers), and keep cron schedules and variables unchanged.
5. Trigger a new deployment, then check that the build log shows pnpm install --frozen-lockfile and that GET /health reports 1.18.5 with "database":"ok".

Never point these services at the repo-root Dockerfile (that's the dashboard image). Details: docs/RAILWAY.md. Docker/other platforms: build from the repo root with docker build -f apps/api/Dockerfile ..