chore(iios): production Dockerfile + migrate entrypoint + env/secrets contract

Adds a multi-stage Dockerfile for iios-service (build → pnpm deploy prune →
slim non-root runtime), a docker-entrypoint that runs `prisma migrate deploy`
then starts the server as PID 1, a .dockerignore, a fully-commented
.env.example config contract, and docs/DEPLOYMENT.md (topology, scaling,
release strategy, prod-readiness gaps). Moves prisma to dependencies so the
CLI ships in the prod bundle. Image builds, migrates, and serves /health 200.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/docker-entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# Container entrypoint for iios-service.
+# 1) Apply pending DB migrations (idempotent; safe to run on every boot).
+# 2) Exec the server as PID 1 so signals (SIGTERM) reach Node for graceful shutdown.
+#
+# NOTE: at higher replica counts, prefer running `prisma migrate deploy` ONCE as a
+# separate pre-deploy job/init-container and set IIOS_SKIP_MIGRATE=1 here, so N
+# replicas don't race the migration on rollout.
+set -e
+
+if [ "${IIOS_SKIP_MIGRATE:-0}" != "1" ]; then
+  echo "[entrypoint] applying migrations (prisma migrate deploy)…"
+  node_modules/.bin/prisma migrate deploy
+else
+  echo "[entrypoint] IIOS_SKIP_MIGRATE=1 — skipping migrations"
+fi
+
+echo "[entrypoint] starting iios-service on :${PORT:-3200}"
+exec node dist/main.js