fix(docker): copy all declared workspace package.json files; wire ENTRYPOINT to CLI

Two unrelated breakages that prevented the documented `docker build .`
followed by `docker run docx-corpus <subcommand>` workflow from working
for any user.

1. Workspaces: the COPY block only copied apps/cli/package.json, but the
   root package.json declares apps/cdx-filter and apps/site as workspaces
   too. bun install aborted with "Workspace not found" for both. Added
   the missing COPY lines so the image faithfully mirrors the project's
   declared workspaces. (Mirrors reality rather than stubbing them out -
   keeps the build container honest with the source repo.)

2. Entrypoint: README documents `docker run ... docx-corpus scrape
   --batch 100`, but the entrypoint was `tail -f /dev/null` which
   ignored args. Switched to ENTRYPOINT bun run /app/apps/cli/index.ts
   with CMD --help so the documented invocation works and no-args runs
   show usage.

Verified the failing bun install step by replicating the Dockerfile's
COPY+install sequence in a temp directory: 1809 packages installed
cleanly. Verified the CLI's --help argument produces the documented
usage output.

Author: caiopizzol

Dockerfile

@@ -8,15 +8,18 @@ RUN apt-get update && apt-get install -y python3 python3-venv curl --no-install-
     && curl -LsSf https://astral.sh/uv/install.sh | sh
 ENV PATH="/root/.local/bin:$PATH"
 
-# Copy package files for caching
+# Copy package files for caching. The set must match the workspaces array
+# in the root package.json, otherwise bun install fails on missing workspaces.
 COPY package.json bun.lock ./
 COPY packages/shared/package.json ./packages/shared/
 COPY packages/scraper/package.json ./packages/scraper/
 COPY packages/extractor/package.json ./packages/extractor/
 COPY packages/embedder/package.json ./packages/embedder/
+COPY apps/cdx-filter/package.json ./apps/cdx-filter/
 COPY apps/cli/package.json ./apps/cli/
+COPY apps/site/package.json ./apps/site/
 
-# Install TS dependencies (strip devDeps — biome/lefthook not needed in container)
+# Install TS dependencies (strip devDeps - biome/lefthook not needed in container)
 RUN python3 -c "import json; p=json.load(open('package.json')); p.pop('devDependencies',None); json.dump(p,open('package.json','w'),indent=2)"
 RUN bun install --ignore-scripts --no-frozen-lockfile
 
@@ -40,4 +43,7 @@ COPY packages/ ./packages/
 COPY apps/cli/ ./apps/cli/
 COPY scripts/ ./scripts/
 
-ENTRYPOINT ["tail", "-f", "/dev/null"]
+# Entrypoint matches the documented usage in README ("docker run ... <subcommand> [args]").
+# Invokes the CLI directly; `docker run docx-corpus` with no args shows `corpus --help`.
+ENTRYPOINT ["bun", "run", "/app/apps/cli/index.ts"]
+CMD ["--help"]