feat(hardening): M-Hard 6 + 7 — PostgreSQL backend + production server infra

M-Hard 6: PostgreSQL Storage Backend
- @shade/storage-postgres with PostgresStorage + PostgresPrekeyStore
- Drizzle-style raw SQL ensureClientTables / ensurePrekeyServerTables
- All tables prefixed `shade_` to avoid collisions in shared databases
- DELETE ... FOR UPDATE SKIP LOCKED for concurrent OTPK consumption
- Tests skip gracefully without SHADE_TEST_PG_URL, run against real PG when set

M-Hard 7: Production Server Infrastructure
- Structured JSON logger (logger.ts) — SHADE_LOG_LEVEL configurable
- Health endpoints (/health, /healthz, /ready) — Kubernetes-friendly
- Prometheus metrics (/metrics) — counters, histograms, middleware
- Graceful shutdown with SIGTERM/SIGINT handlers + store close
- Production Dockerfile with non-root user, healthcheck, multi-stage build
- docker-compose.yml example for Dokploy with optional PostgreSQL

193 tests passing, 0 failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/shade-server/Dockerfile

@@ -1,11 +1,51 @@
+# ─── Build stage ────────────────────────────────────────────
+FROM oven/bun:1 AS builder
+
+WORKDIR /build
+
+# Copy workspace root
+COPY package.json bun.lock ./
+COPY tsconfig.json ./
+
+# Copy all packages we depend on
+COPY packages/shade-core ./packages/shade-core
+COPY packages/shade-crypto-web ./packages/shade-crypto-web
+COPY packages/shade-server ./packages/shade-server
+COPY packages/shade-storage-sqlite ./packages/shade-storage-sqlite
+COPY packages/shade-storage-postgres ./packages/shade-storage-postgres
+
+RUN bun install --frozen-lockfile
+
+# ─── Production stage ───────────────────────────────────────
 FROM oven/bun:1-alpine
 
-WORKDIR /app
-COPY package.json bun.lock ./
-RUN bun install --production --frozen-lockfile
+LABEL org.opencontainers.image.title="Shade Prekey Server"
+LABEL org.opencontainers.image.description="E2EE prekey distribution server (Signal Protocol)"
+LABEL org.opencontainers.image.source="https://github.com/Sterister/Shade"
+LABEL org.opencontainers.image.licenses="MIT"
 
-COPY src/ src/
+# Install curl for healthcheck
+RUN apk add --no-cache curl
+
+# Non-root user
+RUN addgroup -S shade && adduser -S shade -G shade
+
+WORKDIR /app
+COPY --from=builder --chown=shade:shade /build /app
+
+# Persistent data directory
+RUN mkdir -p /data && chown shade:shade /data
+VOLUME ["/data"]
+
+USER shade
 
 EXPOSE 3900
 
-CMD ["bun", "run", "src/standalone.ts"]
+# Default to SQLite on the persistent volume
+ENV SHADE_PREKEY_DB_PATH=/data/shade-prekeys.db
+ENV PORT=3900
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD curl -fsS http://localhost:${PORT}/health || exit 1
+
+CMD ["bun", "run", "packages/shade-server/src/standalone.ts"]