Read CI env from Infisical and give the local stack its own ports

CI reads Infisical staging as the read-only convexmonorepo-base-ci machine identity, runs the quality gate, and builds and pushes the image. The template is not deployed, so there is no Convex or VPS deploy step. The local stack moves to its own Compose name and ports so it runs beside the Payload template's, and it syncs the Convex runtime env. The scripts pick up Infisical account switching, dev-kill and a cache-safe CI install.

docker/Dockerfile

@@ -1,16 +1,18 @@
 # syntax=docker/dockerfile:1
-FROM docker.io/oven/bun:1.3.10-alpine AS base
+FROM docker.io/oven/bun:1.3.14-alpine AS base
 
 # Builder stage
 FROM base AS builder
-RUN apk add --no-cache libc6-compat
+RUN apk add --no-cache curl libc6-compat
 WORKDIR /app
 
 ARG SENTRY_AUTH_TOKEN
 ARG SENTRY_DISABLE_AUTO_UPLOAD=false
 ARG NEXT_PUBLIC_SITE_URL
 ARG NEXT_PUBLIC_CONVEX_URL
-ARG NEXT_PUBLIC_PLAUSIBLE_URL
+ARG NEXT_PUBLIC_PLAUSIBLE_SRC
+ARG NEXT_PUBLIC_POSTHOG_KEY
+ARG NEXT_PUBLIC_POSTHOG_HOST
 ARG NEXT_PUBLIC_SENTRY_DSN
 ARG NEXT_PUBLIC_SENTRY_URL
 ARG NEXT_PUBLIC_SENTRY_ORG
@@ -20,7 +22,9 @@ ENV SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN
 ENV SENTRY_DISABLE_AUTO_UPLOAD=$SENTRY_DISABLE_AUTO_UPLOAD
 ENV NEXT_PUBLIC_SITE_URL=$NEXT_PUBLIC_SITE_URL
 ENV NEXT_PUBLIC_CONVEX_URL=$NEXT_PUBLIC_CONVEX_URL
-ENV NEXT_PUBLIC_PLAUSIBLE_URL=$NEXT_PUBLIC_PLAUSIBLE_URL
+ENV NEXT_PUBLIC_PLAUSIBLE_SRC=$NEXT_PUBLIC_PLAUSIBLE_SRC
+ENV NEXT_PUBLIC_POSTHOG_KEY=$NEXT_PUBLIC_POSTHOG_KEY
+ENV NEXT_PUBLIC_POSTHOG_HOST=$NEXT_PUBLIC_POSTHOG_HOST
 ENV NEXT_PUBLIC_SENTRY_DSN=$NEXT_PUBLIC_SENTRY_DSN
 ENV NEXT_PUBLIC_SENTRY_URL=$NEXT_PUBLIC_SENTRY_URL
 ENV NEXT_PUBLIC_SENTRY_ORG=$NEXT_PUBLIC_SENTRY_ORG
@@ -36,7 +40,7 @@ RUN bun install --frozen-lockfile
 # Build with proper environment
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV NODE_ENV=production
-RUN cd apps/next && bun run build:docker
+RUN sh scripts/build-next-bundle
 
 # Runner stage
 FROM docker.io/library/node:22-alpine AS runner