fix: harden update pipeline and restore a clean production build

- update-Nitrov3.sh: build CMS into .next-staging and swap atomically so a
  failed build never takes the live site down; auto-merge new variables
  from .env.example; validate env for duplicates/broken lines; restart the
  emulator/CMS only when rebuilt or unhealthy; fix step renumbering
- next.config.ts: support NEXT_DIST_DIR for staged production builds
- fix all TS errors (unused imports, missing tryDownloadCandidates helper)
  so tsc and the production build pass clean
- add Dockerfile/.dockerignore and switch docker-compose to a CMS container
- include prevailing UI/refactor changes (SurfaceCard, ticketing, tsconfig)

docker-compose.yml

@@ -1,11 +1,20 @@
 version: "3.8"
 
 services:
-  flaresolverr:
-    image: flaresolverr/flaresolverr:latest
-    container_name: flaresolverr
+  cms:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: epicnext-cms
     ports:
-      - "8191:8191"
+      # Host port -> container port (container always listens on 3002)
+      - "3002:3002"
     restart: unless-stopped
-    environment:
-      - LOG_LEVEL=info
+    env_file:
+      - .env
+    volumes:
+      # ~3GB client assets live on the host; mount them read-only into the container
+      - ./public/nitro-assets:/app/public/nitro-assets:ro
+      - ./public/swf:/app/public/swf:ro
+      # Runtime uploaded media (persistent on the host)
+      - ./storage:/app/storage