feat(operator): production build + k3s deployment

- Dockerfile for the operator app (same pattern as portal/booking).
- Env-driven auth/app base URLs in nuxt.config so one build serves
  dev (.local) and production (.eu).
- Deployment + Service + Ingress on operator.dezky.eu.
- Add operator to the typecheck matrix.

apps/operator/Dockerfile

@@ -0,0 +1,24 @@
+# Production image for the dezky operator portal (Nuxt SSR).
+# Build context = this directory (apps/operator).
+# syntax=docker/dockerfile:1
+
+FROM node:22-alpine AS build
+WORKDIR /app
+RUN corepack enable
+# Install deps first for layer caching (pnpm version comes from packageManager).
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+COPY . .
+RUN pnpm build
+
+FROM node:22-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+ENV HOST=0.0.0.0
+ENV PORT=3000
+ENV NUXT_PUBLIC_OPERATOR_URL=https://operator.dezky.eu
+# OIDC, NUXT_PUBLIC_AUTH_URL and PLATFORM_API_INTERNAL_URL are injected at
+# deploy time (see infrastructure/production/fleet/README.md).
+COPY --from=build /app/.output ./.output
+EXPOSE 3000
+CMD ["node", ".output/server/index.mjs"]

apps/operator/nuxt.config.ts

@@ -2,6 +2,14 @@
 // Separate app from apps/portal — different OAuth client, different cookies,
 // different domain, stricter authorization. See docs/OPERATOR-PLAN.md.
 
+// Base URLs are environment-driven so one build runs in dev (.local) and
+// production (.eu) — same approach as apps/portal. Set at BUILD (CI) and
+// RUNTIME (fleet/apps/operator.yaml + operator-secrets); the .local defaults
+// keep local dev working with no env.
+const AUTH_URL = (process.env.NUXT_PUBLIC_AUTH_URL || 'https://auth.dezky.local').replace(/\/$/, '')
+const OPERATOR_URL = (process.env.NUXT_PUBLIC_OPERATOR_URL || 'https://operator.dezky.local').replace(/\/$/, '')
+const OPERATOR_OIDC_APP_SLUG = process.env.OPERATOR_OIDC_APP_SLUG || 'dezky-operator'
+
 export default defineNuxtConfig({
   compatibilityDate: '2026-01-01',
   devtools: { enabled: true },
@@ -52,13 +60,13 @@ export default defineNuxtConfig({
       oidc: {
         clientId: process.env.NUXT_OIDC_CLIENT_ID || '',
         clientSecret: process.env.NUXT_OIDC_CLIENT_SECRET || '',
-        redirectUri: process.env.NUXT_OIDC_REDIRECT_URI || '',
-        authorizationUrl: 'https://auth.dezky.local/application/o/authorize/',
-        tokenUrl: 'https://auth.dezky.local/application/o/token/',
-        userInfoUrl: 'https://auth.dezky.local/application/o/userinfo/',
-        logoutUrl: 'https://auth.dezky.local/application/o/dezky-operator/end-session/',
+        redirectUri: process.env.NUXT_OIDC_REDIRECT_URI || `${OPERATOR_URL}/auth/oidc/callback`,
+        authorizationUrl: `${AUTH_URL}/application/o/authorize/`,
+        tokenUrl: `${AUTH_URL}/application/o/token/`,
+        userInfoUrl: `${AUTH_URL}/application/o/userinfo/`,
+        logoutUrl: `${AUTH_URL}/application/o/${OPERATOR_OIDC_APP_SLUG}/end-session/`,
         openIdConfiguration:
-          'https://auth.dezky.local/application/o/dezky-operator/.well-known/openid-configuration',
+          `${AUTH_URL}/application/o/${OPERATOR_OIDC_APP_SLUG}/.well-known/openid-configuration`,
         scope: ['openid', 'profile', 'email', 'groups'],
         userNameClaim: 'preferred_username',
         responseType: 'code',