fix: install dependencies in a safer Docker build order

Dockerfile

@@ -1,20 +1,19 @@
 FROM mcr.microsoft.com/playwright:v1.60.0-noble
 
-RUN useradd -m -u 1000 user \
-    && mkdir -p /home/user/app \
-    && chown -R user:user /home/user
+RUN useradd -m -u 1000 user
 
 ENV HOME=/home/user
 ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
 
-WORKDIR $HOME/app
+WORKDIR /home/user/app
 
-COPY --chown=user:user package*.json ./
+COPY package*.json ./
+RUN npm install --omit=dev --ignore-scripts --no-audit --no-fund
 
-USER user
-RUN npm ci --omit=dev
+COPY . .
+RUN chown -R user:user /home/user/app
 
-COPY --chown=user:user . .
+USER user
 
 ENV NODE_ENV=production
 ENV HOST=0.0.0.0