fix: build image libraries for baseline VPS CPUs

Replace the SIMD-dependent WebAssembly fallback with source-built libvips and Sharp. Pin the libvips archive checksum, use baseline x86-64 compiler flags, retain the native binding and runtime libraries, and check JPEG/PNG/WebP processing before compilation and in the runtime image.

Lint, type checking, and content/security tests passed. Full Docker verification was stopped at the user request; production build and baseline CPU runtime verification remain pending.

Dockerfile

@@ -1,14 +1,33 @@
 # syntax=docker/dockerfile:1.7
 
-FROM node:22-alpine AS dependencies
+FROM node:22-alpine AS image-runtime
+
+# Distribution libraries support baseline CPUs and dispatch optional SIMD at runtime.
+RUN apk add --no-cache glib expat libjpeg-turbo libpng libwebp tiff lcms2 librsvg libstdc++
+
+FROM image-runtime AS image-build
+RUN apk add --no-cache python3 make g++ meson ninja pkgconf xz \
+    glib-dev expat-dev libjpeg-turbo-dev libpng-dev libwebp-dev tiff-dev lcms2-dev librsvg-dev
+
+ADD --checksum=sha256:3c41e1d5458081bfa4a5bc54e116c46259c75c6760a18027764555632b9dda3e https://github.com/libvips/libvips/releases/download/v8.18.6/vips-8.18.6.tar.xz /tmp/vips.tar.xz
+RUN if [ "$(uname -m)" = x86_64 ]; then export CFLAGS='-O2 -march=x86-64 -mtune=generic' CXXFLAGS='-O2 -march=x86-64 -mtune=generic'; fi \
+    && mkdir /tmp/vips && tar -xJf /tmp/vips.tar.xz -C /tmp/vips --strip-components=1 \
+    && meson setup /tmp/vips/build /tmp/vips --prefix=/opt/vips --libdir=lib \
+      --buildtype=release --auto-features=disabled \
+      -Dhighway=disabled -Dorc=disabled -Dcplusplus=true -Dexamples=false \
+      -Djpeg=enabled -Dpng=enabled -Dwebp=enabled -Dtiff=enabled -Dlcms=enabled -Drsvg=enabled -Dzlib=enabled \
+    && meson compile -C /tmp/vips/build -j 2 \
+    && meson install -C /tmp/vips/build
+
+FROM image-build AS dependencies
 
 WORKDIR /app
 
-# npm may build the native SQLite binding when no matching prebuild is available.
-RUN apk add --no-cache python3 make g++
-
 ARG NPM_REGISTRY=https://package-mirror.liara.ir/repository/npm/
-ENV NEXT_TELEMETRY_DISABLED=1
+ENV NEXT_TELEMETRY_DISABLED=1 \
+    PKG_CONFIG_PATH=/opt/vips/lib/pkgconfig \
+    LD_LIBRARY_PATH=/opt/vips/lib \
+    npm_config_nodedir=/usr/local
 
 COPY package.json package-lock.json ./
 RUN --mount=type=cache,id=portfolio-npm-node22,target=/root/.npm,sharing=locked \
@@ -17,8 +36,12 @@ RUN --mount=type=cache,id=portfolio-npm-node22,target=/root/.npm,sharing=locked
     --replace-registry-host=registry.npmjs.org \
     --include=optional
 
+# Compile Sharp against our baseline libvips, not its x86-64-v2 prebuilt binary.
+RUN if [ "$(uname -m)" = x86_64 ]; then export CFLAGS='-O2 -march=x86-64 -mtune=generic' CXXFLAGS='-O2 -march=x86-64 -mtune=generic'; fi \
+    && npm explore sharp -- npm run build
+
 COPY scripts/check-image-runtime.mjs ./scripts/check-image-runtime.mjs
-RUN node scripts/check-image-runtime.mjs
+RUN node scripts/check-image-runtime.mjs --require-source
 
 FROM dependencies AS verification
 
@@ -29,14 +52,15 @@ RUN --mount=type=cache,id=portfolio-next-node22,target=/app/.next/cache,sharing=
   npm run build
 RUN npm test
 
-FROM node:22-alpine AS runtime
+FROM image-runtime AS runtime
 
 WORKDIR /app
 ENV NODE_ENV=production \
     NEXT_TELEMETRY_DISABLED=1 \
     HOSTNAME=0.0.0.0 \
     PORT=3000 \
-    DATA_DIR=/data
+    DATA_DIR=/data \
+    LD_LIBRARY_PATH=/opt/vips/lib
 
 RUN addgroup --system --gid 1001 nodejs \
   && adduser --system --uid 1001 nextjs
@@ -44,6 +68,11 @@ RUN addgroup --system --gid 1001 nodejs \
 COPY --from=verification --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=verification --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=verification --chown=nextjs:nodejs /app/public ./public
+COPY --from=image-build /opt/vips/lib /opt/vips/lib
+# Explicitly retain the custom binding even if Next's file tracer misses it.
+COPY --from=dependencies --chown=nextjs:nodejs /app/node_modules/sharp/src/build/Release/*.node ./node_modules/sharp/src/build/Release/
+COPY scripts/check-image-runtime.mjs ./scripts/check-image-runtime.mjs
+RUN node scripts/check-image-runtime.mjs --require-source
 RUN mkdir -p .next/cache /data && chown -R nextjs:nodejs .next/cache /data
 
 USER nextjs