ci(docker): build server/ instead of api/ as the published image

The published ghcr.io/sentinel-bluebuilder/x402:latest image was being
built from api/ (the on-chain-event design), so anyone running the
docker-compose was actually getting the api/ implementation, not the
canonical EIP-3009 server/ described in the README.

- Add server/Dockerfile (multi-stage build, no DB volume, runs as
  unprivileged user, exposes 4020; self-hosted facilitator binds
  4021 internally inside the container)
- Add server/docker-compose.yml (matches the previous api/ compose
  shape so existing deployments only need a port + env-var update)
- Update .github/workflows/build.yml to watch server/** and build
  from ./server/Dockerfile

Operators upgrading from the api/ image will need to swap envs:
remove PAYMENT_CONTRACT_ADDRESS, OPERATOR_EVM_ADDRESS, HELIUS_*,
PRICE_PER_DAY_USDC, MIN_DAYS, MAX_DAYS, DATABASE_PATH; add
OPERATOR_ADDRESS, FACILITATOR_PRIVATE_KEY (or CDP_API_KEY_*); change
the published port from 3402 to 4020.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 2 people

.github/workflows/build.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [ "master" ]
     paths:
-      - "api/**"
+      - "server/**"
       - ".github/workflows/build.yml"
   workflow_dispatch:
 
@@ -36,8 +36,8 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           push: true
-          context: ./api
-          file: ./api/Dockerfile
+          context: ./server
+          file: ./server/Dockerfile
           tags: |
             ghcr.io/${{ env.REPO }}:latest
             ghcr.io/${{ env.REPO }}:${{ github.sha }}

server/Dockerfile

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1.7
+
+# ─── Build the server ───
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY package.json package-lock.json* ./
+RUN npm ci
+COPY tsconfig.json ./
+COPY src ./src
+RUN npm run build
+
+# ─── Production deps only ───
+FROM node:22-alpine AS deps
+WORKDIR /app
+COPY package.json package-lock.json* ./
+RUN npm ci --omit=dev
+
+# ─── Runtime ───
+FROM node:22-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=4020
+ENV FACILITATOR_PORT=4021
+
+RUN addgroup -S app && adduser -S app -G app
+
+COPY --from=deps  /app/node_modules ./node_modules
+COPY --from=build /app/dist         ./dist
+COPY package.json ./
+
+USER app
+
+EXPOSE 4020
+
+CMD ["node", "dist/index.js"]

server/docker-compose.yml

@@ -0,0 +1,10 @@
+services:
+  backend:
+    image: ghcr.io/sentinel-bluebuilder/x402:latest
+    container_name: x402
+    restart: unless-stopped
+    pull_policy: always
+    env_file:
+      - .env
+    ports:
+      - "4020:4020"