fix(docker): API image could never boot — missing workspace link and Prisma engine

Two independent defects in docker/api.Dockerfile, both found by booting the
published image on galactus rather than by reading it. Neither had ever been
observed because no deploy had previously got far enough to start the API.

1. "Cannot find module '@jorgecuadros/database'".
   node-linker=hoisted flattens EXTERNAL dependencies into /repo/node_modules,
   but the workspace dependency stays linked per-package at
   apps/api/node_modules/@jorgecuadros/database -> ../../../../packages/database.
   The runtime stage copied only /repo/node_modules, so the link was dropped.
   Copy the @jorgecuadros scope dir as well — not the whole directory, whose
   only other contents are devDependencies.

2. "Prisma Client could not locate the Query Engine for runtime
   linux-musl-openssl-3.0.x ... generated for linux-musl".
   Prisma picks its engine by sniffing the build environment. The build stage
   had no openssl so it generated for plain "linux-musl", while the runtime
   stage demanded the openssl-3.0.x variant and refused to start. Fixed at both
   ends: binaryTargets now names the musl target explicitly in schema.prisma,
   so the shipped engine no longer depends on what happens to be installed at
   build time, and openssl is installed in the deps stage (generate) and the
   runtime stage (Prisma needs it regardless).

Verified by running the published image on galactus with each fix patched in
by hand, against the real database, until it got past both failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/database/prisma/schema.prisma

@@ -8,6 +8,13 @@
 generator client {
   provider = "prisma-client-js"
   output   = "../generated/client"
+  // "native" covers local dev. The musl target is declared EXPLICITLY because
+  // Prisma picks the engine by sniffing the build environment: the Docker build
+  // stage has no openssl, so it detected plain "linux-musl", while the runtime
+  // stage (which needs openssl for other reasons) then demanded
+  // "linux-musl-openssl-3.0.x" and refused to start. Naming it here makes the
+  // engine that ships independent of what happens to be installed at build time.
+  binaryTargets = ["native", "linux-musl-openssl-3.0.x"]
 }
 
 datasource db {