- Add ENV NODE_ENV=production in production stage after WORKDIR /app/apps/api - Engages the devBypass.ts hard guard so DEV_AUTH_BYPASS can never inject DEV_USER in the shipped image, even if accidentally set (D-07) - No other stage (base/builder/dev/pwa-builder) is affected