[TheGreatAxios]

Closes CL-11867

What changed

• The Dockerfile splits a source stage from two installs: the full install still feeds the web build, and a new deps stage runs bun install --production for the hub and sidecar images.
• better-auth lists drizzle-kit as an optional peer, so deps also removes drizzle-kit and its esbuild binaries after installing; only migration generation uses them, and nothing at runtime imports them.
• drizzle-kit leaves the hub's runtime dependencies (the root dev dependency keeps db:generate working); @corbits/react-ui becomes a coder runtime dependency, because the hub resolves it at startup; the web build moves to Vite 6.4.5.

How it was verified

• A manual publish run on this branch builds both images for amd64 and arm64 and both pass the Trivy scan (critical and high, fixable), which failed on main before.
• bun run lint, typecheck, pins:verify, format:check and test (66 pass) pass.
• Not yet run: starting the hub and a sidecar from the new images.

[linear-code]

CL-11867

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Notes:

• changes sensitive paths: ci: deploy/Dockerfile, locks: bun.lock

Triage will approve, request review.