Fix the slow, root-running Dockerfile

Task

A Node.js service's image takes over three minutes to rebuild after any code change, because every build reinstalls all dependencies. Security has also flagged that the container runs as root.

Edit the Dockerfile so that:

• the dependency install is cached when only source code changes (the package manifest is copied, and dependencies installed, before the rest of the source is copied in)
• dependencies are installed with a clean, lockfile-exact install
• the container runs as a non-root user

The base image node:22 already includes an unprivileged user called node.

Dockerfile