chore: optimize docker image and scanner performance

Dockerfile

@@ -1,30 +1,33 @@
 ARG NODE_IMAGE=node:24.11-alpine
 
-# Stage 1: Build client
-FROM ${NODE_IMAGE} AS client-builder
+FROM ${NODE_IMAGE} AS base
 RUN npm install -g pnpm@10
+
+# Stage 1: Build client
+FROM base AS client-builder
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
-COPY packages/ packages/
+COPY packages/types/package.json ./packages/types/
 COPY client/package.json ./client/
 RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
     pnpm install --filter client... --frozen-lockfile
 
+COPY packages/ ./packages/
 COPY client/ ./client/
 RUN pnpm --filter client run build-only
 
 # Stage 2: Build server + create deploy bundle
-FROM ${NODE_IMAGE} AS server-builder
-RUN npm install -g pnpm@10
+FROM base AS server-builder
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
-COPY packages/ packages/
+COPY packages/types/package.json ./packages/types/
 COPY server/package.json ./server/
 RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
     pnpm install --filter server... --frozen-lockfile
 
+COPY packages/ ./packages/
 COPY server/ ./server/
 RUN pnpm --filter server run build
 
@@ -38,6 +41,7 @@ FROM ${NODE_IMAGE} AS runtime
 WORKDIR /app
 
 RUN apk upgrade --no-cache && \
+    apk add --no-cache poppler-utils && \
     rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 ENV NODE_ENV=production
@@ -56,4 +60,4 @@ EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
   CMD node -e "const p=process.env.PORT||3000;fetch('http://127.0.0.1:'+p+'/api/v1/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
 
-CMD ["sh", "entrypoint.sh"]
+CMD ["sh", "/app/entrypoint.sh"]