Install deps above WORKDIR so no root-owned node_modules lands in the checkout

Dockerfile

@@ -1,14 +1,19 @@
 # Node 24 runs TypeScript directly (type stripping) — no build step. Pinned exact tag.
 FROM node:24.19.0-alpine3.24
 
+# Deps land at /node_modules, one level above WORKDIR: Node resolves upward, so dev's `.:/app`
+# bind mount cannot shadow them. Mounting a volume at /app/node_modules instead has the daemon
+# create that destination in the developer's own checkout, root-owned whatever user runs the
+# container. Reproducible install from the lockfile; dev deps kept so typecheck/test run in-image.
+COPY package.json package-lock.json .npmrc /deps/
+RUN cd /deps && npm ci && mv node_modules /node_modules && rm -rf /deps
+
 WORKDIR /app
-
-# Reproducible install from the lockfile. Dev deps kept so typecheck/test run in-image.
-COPY package.json package-lock.json .npmrc ./
-RUN npm ci
-
 COPY . .
 
+# Lockfile edits run as the host user (README → Extending the core) so the rewritten files stay
+# theirs; that uid has no home in this image, and npm's default cache would land in unwritable /.
+ENV npm_config_cache=/tmp/.npm
 ENV PORT=3000
 EXPOSE 3000
 CMD ["node", "src/server.ts"]