update docker

Dockerfile

@@ -10,20 +10,10 @@ WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
 
-# Copy source
+# Copy source and build — no VITE_* args needed at build time.
+# Supabase keys are injected at runtime via docker/entrypoint.sh → window.__ENV__
 COPY . .
-
-# VITE_* vars are Supabase public keys — safe for browser, baked into bundle at build time.
-# Using ARG only (no ENV) so values don't persist as image-layer env vars.
-ARG VITE_SUPABASE_URL
-ARG VITE_SUPABASE_ANON_KEY
-ARG VITE_SUPABASE_PUBLISHABLE_KEY
-
-# Pass vars inline so they're scoped to this RUN layer only
-RUN VITE_SUPABASE_URL="$VITE_SUPABASE_URL" \
-    VITE_SUPABASE_ANON_KEY="$VITE_SUPABASE_ANON_KEY" \
-    VITE_SUPABASE_PUBLISHABLE_KEY="$VITE_SUPABASE_PUBLISHABLE_KEY" \
-    npm run build
+RUN npm run build
 
 # ============================================================
 # Stage 2 — Serve
@@ -37,6 +27,10 @@ COPY nginx.conf /etc/nginx/conf.d/default.conf
 # Copy built static files from builder
 COPY --from=builder /app/dist /usr/share/nginx/html
 
+# Entrypoint generates env.js from runtime env vars before starting nginx
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
 EXPOSE 80
 
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["/entrypoint.sh"]