feat(docker): add new staging docker file

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+## 📝 Description
+## 🛠️ Type of Change
+- [ ] 🚀 New Feature
+- [ ] 🐛 Bug Fix
+- [ ] 🧹 Refactor / Cleanup
+- [ ] 📄 Documentation Update
+
+## ✅ Pre-Merge Checklist
+- [ ] My code follows the project's style guidelines.
+- [ ] I have performed a self-review of my own code.
+- [ ] **Database:** I have checked if this PR requires a migration.
+- [ ] **Testing:** I have added/updated tests that prove my fix is effective.
+- [ ] **Performance:** I have verified this won't slow down the 100k req/min target.
+- [ ] **Security:** No sensitive student data is exposed in logs.
+
+## 📸 Screenshots (Optional)
+## 🔗 Related Issues
+Fixes # (issue number)

.husky/pre-push

@@ -1,6 +1,12 @@
 # Get the current branch name
 current_branch=$(git rev-parse --abbrev-ref HEAD)
 
+# Block direct pushes to main
+if [ "$current_branch" = "main" ]; then
+  echo "❌ You cannot push directly to main! Use a PR."
+  exit 1
+fi
+
 echo "🚀 Running Final Type Check on [$current_branch]..."
 
 bun x tsc --noEmit --skipLibCheck || { 

Dockerfile.staging

@@ -0,0 +1,33 @@
+# ── Stage 1: Install dependencies ──────────────────────────────────────────
+FROM oven/bun:1 AS deps
+WORKDIR /app
+
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile --production
+
+# ── Stage 2: Build / prepare source ───────────────────────────────────────
+FROM oven/bun:1 AS build
+WORKDIR /app
+
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+
+COPY tsconfig.json ./
+COPY src ./src
+
+# Type-check (catches errors before deploying to staging)
+RUN bun x tsc --noEmit --skipLibCheck
+
+# ── Stage 3: Production-like runtime ─────────────────────────────────────
+FROM oven/bun:1 AS runtime
+WORKDIR /app
+
+ENV NODE_ENV=staging
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=build /app/package.json ./
+COPY --from=build /app/tsconfig.json ./
+COPY --from=build /app/src ./src
+
+EXPOSE 3000
+CMD ["sh", "-c", "bunx drizzle-kit migrate --config=src/config/drizzle.config.ts && bun run src/server.ts"]

docker-compose.staging.yml

@@ -16,12 +16,10 @@ services:
   backend:
     build:
       context: .
-      dockerfile: Dockerfile
+      dockerfile: Dockerfile.staging
     ports:
       - "${PORT}:${PORT}"
     env_file: .env.staging
-    # No ./src volume mount — the image contains the built source.
-    # Schema was already pushed by the CI deploy step; just start the server.
     command: sh -c "bun run src/server.ts"
     restart: unless-stopped
     depends_on: