refactor: large codebase cleanup - consolidate schemas, migrate to Drizzle ORM, extract frontend components, modernize Docker builds

- Consolidate all DB schema definitions into packages/shared as single source of truth
- Migrate backend from raw SQL to Drizzle ORM across all modules
- Extract frontend inline UI into separate component files
- Refactor discord-gateway circuitBreaker into conversationState + moderationState
- Convert messageStore to Proxy singleton pattern
- Add validateBody/validateQuery middleware + Zod schemas for API endpoints
- Modernize Docker builds with multi-stage + pnpm deploy
- Migrate CI/CD from deployment to image-based pipeline
- Remove 60+ unused/dead files (~15K lines)
- Update color scheme from sky-blue to teal-cyan
- Move DB connection management to @bete/shared/database

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker/Dockerfile.backend

@@ -2,6 +2,12 @@ FROM node:22-slim
 
 WORKDIR /app
 
+# Build args for frontend API URLs
+ARG VITE_BE_API_URL
+ARG VITE_BE_WS_URL
+ENV VITE_BE_API_URL=${VITE_BE_API_URL}
+ENV VITE_BE_WS_URL=${VITE_BE_WS_URL}
+
 # Install pnpm
 RUN npm install -g pnpm
 

infra/docker/Dockerfile.discord-gateway

@@ -1,67 +1,73 @@
+# ---- Stage 1: Build native deps + TypeScript ----
+FROM node:22-slim AS builder
+
+WORKDIR /app
+
+RUN corepack enable
+
+# Build tools + Rust for native compilation
+RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends \
+    python3 make g++ curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+# Dependency manifests
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
+COPY patches ./patches
+COPY packages/shared/package.json ./packages/shared/package.json
+COPY services/discord-gateway/package.json ./services/discord-gateway/package.json
+
+# Install ALL deps (including devDeps needed for build)
+RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile
+
+# Source code
+COPY packages/shared ./packages/shared
+COPY services/discord-gateway ./services/discord-gateway
+COPY services/discord-gateway/drizzle ./drizzle
+
+# Build
+RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
+    pnpm --filter './packages/shared' run build
+RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
+    pnpm --filter './services/discord-gateway' run build
+
+# Create production-only deployment (no devDeps)
+RUN pnpm deploy --filter '@bete/discord-gateway' /tmp/deploy \
+    && rm -rf /tmp/deploy/node_modules/.pnpm/@biomejs+biome@* \
+           /tmp/deploy/node_modules/.pnpm/@biomejs+cli-linux-x64@* \
+           /tmp/deploy/node_modules/.pnpm/typescript@* \
+           /tmp/deploy/node_modules/.pnpm/drizzle-kit@* \
+           /tmp/deploy/node_modules/.pnpm/vitest@* \
+           /tmp/deploy/node_modules/.pnpm/esbuild@* \
+           /tmp/deploy/node_modules/.pnpm/tsx@* \
+           /tmp/deploy/node_modules/.pnpm/@types* \
+           /tmp/deploy/node_modules/.pnpm/@rolldown* \
+           /tmp/deploy/node_modules/.pnpm/@vitest*
+
+# ---- Stage 2: Runtime (minimal) ----
 FROM node:22-slim
 
 WORKDIR /app
 
-# Install pnpm
-RUN npm install -g pnpm
-
-# Create non-root user
-RUN groupadd --system app && useradd --system -g app app
-
-# Install build tools for native dependencies (node-crc, @discordjs/opus)
-# and ffmpeg for voice transmit (PCM to OggOpus encoding)
-# This is done early to cache this expensive layer
+# Runtime system deps only
 RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends \
-    python3 make g++ ffmpeg curl ca-certificates \
+    ffmpeg ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Rust via rustup (Debian's rustc/cargo is too old for node-crc)
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
-ENV PATH="/root/.cargo/bin:${PATH}"
+# Copy production-only artifacts from deploy
+COPY --from=builder /tmp/deploy/node_modules ./node_modules
+COPY --from=builder /tmp/deploy/package.json ./package.json
+COPY --from=builder /app/packages/shared/dist ./packages/shared/dist
+COPY --from=builder /app/services/discord-gateway/dist ./services/discord-gateway/dist
+COPY --from=builder /app/drizzle ./drizzle
 
-# Copy dependency definition files first for better caching
-COPY pnpm-workspace.yaml .
-COPY pnpm-lock.yaml .
-COPY package.json .
+# Create recordings dir and set ownership
+RUN mkdir -p /app/recordings && chown -R node:node /app
+USER node
 
-# Copy patches (pnpm patchedDependencies)
-COPY patches ./patches
-
-# Copy packages (workspace dependencies)
-COPY packages/shared ./packages/shared
-
-# Copy Drizzle migrations (relative path used by migrator)
-COPY services/discord-gateway/drizzle ./drizzle
-
-# Copy service source (last — changes most often)
-COPY services/discord-gateway ./services/discord-gateway
-
-# Install dependencies with build cache
-RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
-    pnpm install --frozen-lockfile
-
-# Build shared workspace dependency first
-RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
-    pnpm --filter './packages/shared' run build
-
-# Build discord gateway
-RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
-    pnpm --filter './services/discord-gateway' run build
-
-# Create recordings directory
-RUN mkdir -p /app/recordings
-
-# Own everything by non-root user
-RUN chown -R app:app /app
-
-# Switch to non-root user
-USER app
-
-# Expose no HTTP port (gateway is internal-only)
-
-# Healthcheck — verify PID 1 (node) is still running (no HTTP server in this service)
 HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
   CMD sh -c "kill -0 1"
 
-# Start discord gateway
 CMD ["node", "services/discord-gateway/dist/index.js"]

infra/docker/Dockerfile.proxy

@@ -1,32 +1,56 @@
-# ---- Builder Stage (Frontend WASM) ----
-FROM rust:alpine AS frontend-builder
-
-RUN apk add --no-cache musl-dev
-RUN rustup target add wasm32-unknown-unknown
-RUN cargo install trunk --version 0.22.0-beta.1 --locked
+# ---- Stage 1: Build Next.js static export ----
+FROM node:22-slim AS frontend-builder
 
 WORKDIR /app
 
-# Copy workspace definition and lock file for dependency caching
-COPY services/frontend/Cargo.toml services/frontend/Cargo.lock ./
+# Install pnpm
+RUN corepack enable
 
-# Copy shared-types library
-COPY services/frontend/shared-types ./shared-types/
+# Install build essentials for native deps
+RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends \
+    python3 make g++ && rm -rf /var/lib/apt/lists/*
 
-# Copy frontend source
-COPY services/frontend/frontend ./frontend/
+# Copy dependency manifests first for layer caching
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
+COPY packages/shared/package.json ./packages/shared/package.json
+COPY services/frontend/package.json ./services/frontend/package.json
+COPY services/frontend/tsconfig.json ./services/frontend/tsconfig.json
 
-# Build WASM bundle via trunk
-RUN cd frontend && trunk build --release
+# Copy patches (pnpm patchedDependencies)
+COPY patches/ ./patches/
 
-# ---- Runner Stage ----
+# Install dependencies (frontend + shared)
+RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
+    pnpm install --no-frozen-lockfile --filter './packages/shared' --filter './services/frontend'
+
+# Copy source code
+COPY packages/shared/ ./packages/shared/
+COPY services/frontend/ ./services/frontend/
+
+# Pass API/WS URLs as build args
+ARG VITE_BE_API_URL
+ARG VITE_BE_WS_URL
+ENV VITE_BE_API_URL=${VITE_BE_API_URL}
+ENV VITE_BE_WS_URL=${VITE_BE_WS_URL}
+
+# Build shared lib first, then frontend static export
+RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
+    pnpm --filter './packages/shared' run build
+RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
+    pnpm --filter frontend run build
+
+# ---- Stage 2: Nginx ----
 FROM nginx:alpine
 
+# Nginx config (API/WS proxy + static file serving)
 COPY infra/docker/nginx/nginx.conf /etc/nginx/conf.d/default.conf
 
-# Copy frontend static files from builder stage
-COPY --from=frontend-builder /app/frontend/dist /usr/share/nginx/html
+# Static export from frontend builder
+COPY --from=frontend-builder /app/services/frontend/out/ /usr/share/nginx/html/
 
 EXPOSE 80
 
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD wget -qO- http://localhost:80/ || exit 1
+
 CMD ["nginx", "-g", "daemon off;"]

infra/docker/docker-compose.yml

@@ -1,10 +1,8 @@
 version: '3.8'
 
 services:
-  # Nginx Reverse Proxy + Frontend Static Files
-  # Routes /api and /ws to backend, serves frontend WASM directly
   proxy:
-    image: registry.gitlab.com/mytheclipse-group/gmw/bete-proxy:${IMAGE_TAG:-latest}
+    image: ${REGISTRY}/mytheclipse/gmw/bete-proxy:${IMAGE_TAG:-latest}
     container_name: imphenbot-proxy
     restart: unless-stopped
     labels:
@@ -20,10 +18,6 @@ services:
       interval: 30s
       timeout: 5s
       retries: 3
-    volumes:
-      # Bind mount for hot-deploy frontend — deploy.sh writes here,
-      # survives container restart. The image default serves as fallback.
-      - ./frontend-dist:/usr/share/nginx/html
     deploy:
       resources:
         limits:
@@ -31,9 +25,8 @@ services:
     networks:
       - app-shared-net
 
-  # Backend Service (REST API + WebSocket)
   backend:
-    image: registry.gitlab.com/mytheclipse-group/gmw/bete-backend:${IMAGE_TAG:-latest}
+    image: ${REGISTRY}/mytheclipse/gmw/bete-backend:${IMAGE_TAG:-latest}
     container_name: imphenbot-backend
     restart: unless-stopped
     env_file:
@@ -41,10 +34,6 @@ services:
     environment:
       NODE_ENV: production
       WEBSERVER_PORT: 3000
-    volumes:
-      # Bind mount for hot-deploy backend JS — deploy.sh writes here,
-      # survives container restart.
-      - ./backend-dist:/app/services/backend/dist
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
       interval: 30s
@@ -58,9 +47,8 @@ services:
     networks:
       - app-shared-net
 
-  # Discord Gateway Service (Event capture and processing — no HTTP)
   discord-gateway:
-    image: registry.gitlab.com/mytheclipse-group/gmw/bete-discord-gateway:${IMAGE_TAG:-latest}
+    image: ${REGISTRY}/mytheclipse/gmw/bete-discord-gateway:${IMAGE_TAG:-latest}
     container_name: imphenbot-discord-gateway
     restart: unless-stopped
     env_file:
@@ -68,10 +56,7 @@ services:
     environment:
       NODE_ENV: production
     volumes:
-      - ./recordings:/app/recordings
-      # Bind mount for hot-deploy gateway JS — deploy.sh writes here,
-      # survives container restart.
-      - ./gateway-dist:/app/services/discord-gateway/dist
+      - recordings:/app/recordings
     healthcheck:
       test: ["CMD-SHELL", "kill -0 1 || exit 1"]
       interval: 30s
@@ -85,6 +70,9 @@ services:
     networks:
       - app-shared-net
 
+volumes:
+  recordings:
+
 networks:
   app-shared-net:
     name: app-shared-net