fix: Dockerfile — all build and runtime issues

Sequential build failures fixed:
1. uv run playwright install chromium → playwright not in pyproject.toml/venv
   Fix: npm install -g @playwright/cli playwright && playwright install chromium
   Also installs @playwright/cli (the browser CLI used by research agents)

2. uv pip install amplifierd → package not on PyPI
   Fix: uv pip install --system from github.com/microsoft/amplifierd
   Also installs amplifier-foundation (also not on PyPI, git-only dep)
   Uses uv (not plain pip) to respect [tool.uv.sources] resolution

3. COPY frontend/dist/ → dist is gitignored, breaks fresh-clone builds
   Fix: build the frontend inside Docker using the installed Node.js
   (npm ci + npm run build); removes the pre-built dist assumption

Other fixes:
- Add git to apt-get (required for pip/uv git+https installs)
- Fix entrypoint.sh: amplifierd uses 'serve' subcommand and NAME=URI
  bundle format — was: amplifierd --port ... --bundle /path
  now: amplifierd serve --port ... --bundle name=/path --default-bundle name
- Add .dockerignore to exclude node_modules, .venv, dist, .git, etc.
  (keeps build context small and avoids stale artifacts in COPY steps)

Dockerfile

@@ -1,12 +1,15 @@
 FROM python:3.13-slim
 
-# Install system dependencies
+# ── System dependencies ────────────────────────────────────────────────────────
+# Includes Xvfb/VNC stack, git (needed for pip's git+https installs),
+# and Chromium runtime libs (for the playwright-managed Chromium binary).
 RUN apt-get update && apt-get install -y --no-install-recommends \
     xvfb \
     x11vnc \
     websockify \
     novnc \
     curl \
+    git \
     libnss3 \
     libatk1.0-0 \
     libatk-bridge2.0-0 \
@@ -25,40 +28,57 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     fonts-liberation \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Node.js 22.x from nodesource.com
+# ── Node.js 22.x ──────────────────────────────────────────────────────────────
 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && rm -rf /var/lib/apt/lists/*
 
-# Install uv via pip
-RUN pip install uv
+# ── npm global tools: @playwright/cli + Chromium browser ──────────────────────
+# @playwright/cli  — token-efficient browser CLI used by research agents
+#                    (playwright-cli -s=research open/snapshot/click/type …)
+# playwright       — provides `playwright install` to download managed Chromium
+# Chromium is installed to /root/.cache/ms-playwright/ (default for root user)
+RUN npm install -g @playwright/cli playwright \
+    && playwright install chromium
 
-# Disable reflinks — overlayfs doesn't support them (EAGAIN inside Docker builds)
+# ── Python tooling ────────────────────────────────────────────────────────────
+RUN pip install uv
+# overlayfs inside Docker doesn't support reflinks → use copy mode to avoid EAGAIN
 ENV UV_LINK_MODE=copy
 
-# Copy backend dependency files and install Python dependencies
+# ── amplifierd: Amplifier session daemon ──────────────────────────────────────
+# Not on PyPI — source is github.com/microsoft/amplifierd.
+# uv pip --system installs to /usr/local/bin/amplifierd (on PATH by default).
+#
+# amplifier-foundation is also not on PyPI (it's a pure git package that
+# amplifierd depends on), so we install it explicitly in the same step.
+# amplifier-core IS on PyPI and will be resolved automatically.
+RUN uv pip install --system \
+    "amplifier-foundation @ git+https://github.com/microsoft/amplifier-foundation@main" \
+    "amplifierd @ git+https://github.com/microsoft/amplifierd"
+
+# ── Frontend: install deps and build ──────────────────────────────────────────
+# Copy package manifests first so npm ci is cached independently of source changes.
+COPY frontend/package.json frontend/package-lock.json /app/frontend/
+WORKDIR /app/frontend
+RUN npm ci
+COPY frontend/ /app/frontend/
+RUN npm run build
+
+# ── Backend: install Python deps ──────────────────────────────────────────────
 COPY backend/pyproject.toml backend/uv.lock /app/backend/
 WORKDIR /app/backend
 RUN uv sync --frozen
 
-# Install Playwright chromium
-RUN uv run playwright install chromium
-
-# Install amplifierd
-RUN uv pip install amplifierd
-
-# Copy application files
+# ── Application files ─────────────────────────────────────────────────────────
 COPY backend/*.py /app/backend/
 COPY bundle/ /app/bundle/
-COPY frontend/dist/ /app/frontend/dist/
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
-# Create artifacts directory
 RUN mkdir -p /app/artifacts
 
 WORKDIR /app
-
 EXPOSE 8080 6080
 
 ENV DISPLAY=:99