fix(docker): raise fd limit so bun install can extract large tarballs

BuildKit gives each RUN a 1024 soft file-descriptor limit against a ~1M
hard limit, and bun extracts tarballs in parallel — a large enough package
exhausts the descriptors and the install dies with "Fail extracting
tarball". It only shows up inside a build, because `docker run` inherits a
far higher limit, which makes it look like a flaky registry.

This bit Nova's deploy (on mermaid) and was fixed there; shade-server has
the identical pattern and escaped only because its layers were cached, so
it would have failed on the next cache-less build. Fixing it at the source
too, so a vendor sync cannot silently drop it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/shade-server/Dockerfile

@@ -9,10 +9,15 @@ COPY package.json bun.lock tsconfig.json ./
 # Copy all packages the server + observer + dashboard need
 COPY packages ./packages
 
-RUN bun install --frozen-lockfile
+# BuildKit gives each RUN a 1024 soft file-descriptor limit while the hard
+# limit is ~1M. bun extracts tarballs in parallel, so a large package can
+# exhaust the descriptors and the install dies with "Fail extracting tarball"
+# — reproducible in a build, invisible outside one because `docker run`
+# inherits a far higher limit. Raise the soft limit to what the host allows.
+RUN ulimit -n "$(ulimit -Hn)" && bun install --frozen-lockfile
 
 # Build the dashboard SPA → dist/, then copy to observer's dist/
-RUN cd packages/shade-dashboard && bun run build
+RUN ulimit -n "$(ulimit -Hn)" && cd packages/shade-dashboard && bun run build
 
 # ─── Production stage ───────────────────────────────────────
 FROM oven/bun:1-alpine