fix(deploy): require prebuilt web artifact for production

tests/unit/test_release_scripts.py

@@ -23,6 +23,9 @@ def test_deploy_production_uses_production_infra_and_project():
     script = Path("infra/docker/deploy-production.sh").read_text(encoding="utf-8")
 
     assert 'HOST_PREFIX="${HOST_PREFIX-/host}"' in script
+    assert "apps/web/dist/index.html" in script
+    assert "Production deploy must not build frontend assets on the server" in script
+    assert "WEB_DOCKERFILE=infra/docker/web-artifact.Dockerfile" in script
     assert "xiaoxia-postgres-production" in script
     assert "xiaoxia-redis-production" in script
     assert "xiaoxia-postgres\n" not in script
@@ -71,9 +74,27 @@ def test_staging_deploy_supports_host_prefix_and_web_build():
 def test_deploy_scripts_build_web_image_explicitly():
     staging_script = Path("infra/docker/deploy-staging.sh").read_text(encoding="utf-8")
     production_script = Path("infra/docker/deploy-production.sh").read_text(encoding="utf-8")
+    compose = Path("infra/docker/compose.yml").read_text(encoding="utf-8")
 
     assert "docker compose build --pull=false web" in staging_script
     assert "docker compose --env-file \"$ENV_FILE\" build --pull=false web" in production_script
+    assert "dockerfile: ${WEB_DOCKERFILE:-infra/docker/web.Dockerfile}" in compose
+
+
+def test_web_artifact_dockerfile_does_not_build_frontend_on_server():
+    dockerfile = Path("infra/docker/web-artifact.Dockerfile").read_text(encoding="utf-8")
+
+    assert "COPY apps/web/dist ./" in dockerfile
+    assert "npm" not in dockerfile
+    assert "node" not in dockerfile.lower()
+
+
+def test_release_artifact_script_builds_web_before_packaging():
+    script = Path("scripts/package_release_artifact.sh").read_text(encoding="utf-8")
+
+    assert "npm ci" in script
+    assert "npm run build" in script
+    assert "--exclude=apps/web/node_modules" in script
 
 
 def test_web_dockerfile_uses_reachable_base_image_mirror():