Fix prod image: move build deps to devDependencies, restore proper npm install

The production stage was using an ad-hoc npm install without package.json,
which could pull unexpected package versions and lost the lockfile guarantee.
Moved all React/build/test/type packages to devDependencies so the production
stage can use npm install --omit=dev cleanly, installing only express, cors,
and docx — exactly what server.js needs. Regenerated lockfile to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -7,7 +7,8 @@ RUN npm run build
 
 FROM node:22-alpine
 WORKDIR /app
-RUN npm install express cors docx
+COPY package*.json ./
+RUN npm install --omit=dev
 COPY server.js ./
 COPY --from=build /app/build ./build
 

package.json

@@ -3,6 +3,11 @@
   "version": "0.1.0",
   "private": true,
   "dependencies": {
+    "cors": "^2.8.6",
+    "docx": "^9.7.1",
+    "express": "^5.2.1"
+  },
+  "devDependencies": {
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
@@ -11,9 +16,6 @@
     "@types/node": "^16.18.126",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "cors": "^2.8.6",
-    "docx": "^9.7.1",
-    "express": "^5.2.1",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-scripts": "5.0.1",