fix(embedder): switch base image to node:20-slim

onnxruntime-node ships glibc-linked native binaries; loading them on
node:20-alpine (musl libc) fails with:

  Error loading shared library ld-linux-x86-64.so.2: No such file or
  directory (needed by …/onnxruntime-node/bin/napi-v3/linux/x64/
  libonnxruntime.so.1.14.0)

Using node:20-slim (Debian) provides glibc and the dynamic linker the
native bindings expect. Image is ~50 MB larger but actually works.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/embedder/Dockerfile

@@ -5,7 +5,9 @@
 # Builds from the repo root: docker build -f apps/embedder/Dockerfile .
 # -----------------------------------------------------------------------------
 
-FROM node:20-alpine AS base
+# node:20-slim instead of -alpine — onnxruntime-node ships glibc-linked
+# binaries and crashes at dlopen time on musl.
+FROM node:20-slim AS base
 RUN corepack enable
 WORKDIR /app
 
@@ -36,16 +38,18 @@ RUN cd apps/embedder \
 RUN pnpm --filter @shared-memory/embedder deploy --prod /deploy
 
 # ---------- runner ----------
-FROM node:20-alpine AS runner
+FROM node:20-slim AS runner
 WORKDIR /app
 ENV NODE_ENV=production \
     PORT=8080 \
     HOST=0.0.0.0 \
     MODEL_CACHE_DIR=/data/models
 
-RUN apk add --no-cache wget \
+RUN apt-get update \
- && addgroup --system --gid 1001 nodejs \
+ && apt-get install -y --no-install-recommends wget ca-certificates \
- && adduser  --system --uid 1001 --ingroup nodejs node-embedder \
+ && rm -rf /var/lib/apt/lists/* \
+ && groupadd --system --gid 1001 nodejs \
+ && useradd  --system --uid 1001 --gid nodejs --no-create-home node-embedder \
  && mkdir -p /data/models \
  && chown -R node-embedder:nodejs /data