Fix prod image: move build deps to devDependencies, restore proper npm install

The production stage was using an ad-hoc npm install without package.json,
which could pull unexpected package versions and lost the lockfile guarantee.
Moved all React/build/test/type packages to devDependencies so the production
stage can use npm install --omit=dev cleanly, installing only express, cors,
and docx — exactly what server.js needs. Regenerated lockfile to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -7,7 +7,8 @@ RUN npm run build
 
 FROM node:22-alpine
 WORKDIR /app
-RUN npm install express cors docx
+COPY package*.json ./
+RUN npm install --omit=dev
 COPY server.js ./
 COPY --from=build /app/build ./build