fix(docker): reconcile pnpm workspace symlinks at container start

The bind mount (.:/app) provides workspace-level node_modules symlinks
from the host, but those target the root node_modules/.pnpm store which
inside the container is a named volume with different content-addressable
hashes. Added `pnpm install --frozen-lockfile` to app-dev-start.sh so
symlinks are regenerated against the container's store on every boot.

Also adds restart.sh convenience script for image rebuilds.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tooling/docker/app-dev-start.sh

@@ -8,6 +8,16 @@ until pg_isready -h "${POSTGRES_HOST:-postgres}" -p "${POSTGRES_PORT:-5432}" -q;
 done
 echo "Postgres is ready."
 
+# The bind mount (.:/app) provides workspace-level node_modules symlinks from
+# the *host*, but those symlinks target the root node_modules/.pnpm store.
+# Inside the container, /app/node_modules is a named volume whose pnpm
+# content-addressable hashes may differ from the host's.  Re-running install
+# regenerates the workspace symlinks so they resolve against the container's
+# pnpm store.  --frozen-lockfile ensures no lock changes; --prefer-offline
+# avoids network round-trips when packages are already cached in the volume.
+# CI=true suppresses interactive prompts (e.g. "reinstall from scratch?")
+CI=true pnpm install --frozen-lockfile
+
 # Regenerate Prisma client (needed after bind-mount overlays the image layer)
 pnpm --filter @capakraken/db db:generate