fix(docker): revert prerender and add configurable secrets

- Remove prerender=true from public pages (caused build failure)
- Add SECRETS_FILE build arg to Dockerfile
- Add docker-build.sh script for local builds
- Remove secrets.dev.yaml from .dockerignore

Author: aster-void

.dockerignore

@@ -7,6 +7,5 @@ build
 .env.*
 !.env.sample
 .sops-age-key.txt
-secrets.dev.yaml
 *.db
 .git

CLAUDE.md

@@ -132,3 +132,7 @@ run `bun tidy` after you finish your work. i.e. before commit
   ```
 
 For detailed coding standards (import order, async patterns, naming conventions), see `docs/knowledges/coding-standards.md`.
+
+# Requirements
+
+do NOT read sops secrets. do NOT read .env.

Dockerfile

@@ -22,16 +22,18 @@ RUN bun run prepare
 
 # Build with sops secrets
 ARG SOPS_AGE_KEY
+ARG SECRETS_FILE=secrets.prod.yaml
 ENV SOPS_AGE_KEY=${SOPS_AGE_KEY}
-RUN sops exec-env secrets.prod.yaml 'bun run build'
+RUN sops exec-env ${SECRETS_FILE} 'bun run build'
 
 FROM base AS executor
 WORKDIR /app
+ARG SECRETS_FILE=secrets.prod.yaml
 
 # Copy built application
 COPY --from=builder /app/build ./build
 COPY --from=builder /app/package.json ./
-COPY secrets.prod.yaml ./secrets.yaml
+COPY ${SECRETS_FILE} ./secrets.yaml
 
 # Copy drizzle migration files and config
 COPY --from=builder /app/drizzle ./drizzle

scripts/docker-build.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SECRETS_FILE="${1:-secrets.dev.yaml}"
+
+SOPS_AGE_KEY=$(cat .sops-age-key.txt)
+docker build \
+  --build-arg SOPS_AGE_KEY="$SOPS_AGE_KEY" \
+  --build-arg SECRETS_FILE="$SECRETS_FILE" \
+  .

src/routes/(site)/+page.server.ts

@@ -13,5 +13,3 @@ export const load: PageServerLoad = async () => {
     allProjects,
   };
 };
-
-export const prerender = true;