feat(operator): production build + k3s deployment

- Dockerfile for the operator app (same pattern as portal/booking).
- Env-driven auth/app base URLs in nuxt.config so one build serves
  dev (.local) and production (.eu).
- Deployment + Service + Ingress on operator.dezky.eu.
- Add operator to the typecheck matrix.

apps/operator/Dockerfile

@@ -0,0 +1,24 @@
+# Production image for the dezky operator portal (Nuxt SSR).
+# Build context = this directory (apps/operator).
+# syntax=docker/dockerfile:1
+
+FROM node:22-alpine AS build
+WORKDIR /app
+RUN corepack enable
+# Install deps first for layer caching (pnpm version comes from packageManager).
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+COPY . .
+RUN pnpm build
+
+FROM node:22-alpine AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+ENV HOST=0.0.0.0
+ENV PORT=3000
+ENV NUXT_PUBLIC_OPERATOR_URL=https://operator.dezky.eu
+# OIDC, NUXT_PUBLIC_AUTH_URL and PLATFORM_API_INTERNAL_URL are injected at
+# deploy time (see infrastructure/production/fleet/README.md).
+COPY --from=build /app/.output ./.output
+EXPOSE 3000
+CMD ["node", ".output/server/index.mjs"]