chore(03): Gate 2 stack bring-up — serve PWA from API image, prod env, credential seed

- Dockerfile: build apps/pwa into the production image's ./public so the API
  serves the PWA on a single port (:3000) for the Pangolin/newt tunnel
- docker-compose.yml: set NODE_ENV=production (mount OIDC unconditionally) and
  constrain OIDC_SCOPES=openid profile email offline_access (Authelia rejected
  the empty-default's full scopes_supported with invalid_scope)
- apps/api/scripts/seed-credential.mjs: operator tool to seed member_credentials
  (encrypted Fastmail app password) out-of-band — fills the documented gap

docker-compose.yml

@@ -5,6 +5,7 @@ services:
       dockerfile: apps/api/Dockerfile
       target: production
     environment:
+      NODE_ENV: production
       DB_HOST: mariadb
       DB_PORT: 3306
       DB_USER: familysync
@@ -16,6 +17,11 @@ services:
       OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
       OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
       OIDC_AUTH_EXTERNAL_URL: ${OIDC_AUTH_EXTERNAL_URL:-}
+      # Constrain requested scopes — @hono/oidc-auth requests ALL of the IdP's
+      # scopes_supported when OIDC_SCOPES is empty (Authelia then rejects with
+      # invalid_scope). offline_access is required for refresh-token session
+      # persistence (D-12/AUTH-02) and must also be allowed on the Authelia client.
+      OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email offline_access}
       APP_PASSWORD_ENCRYPTION_KEY: ${APP_PASSWORD_ENCRYPTION_KEY:-}
     depends_on:
       mariadb: