MVP: Centralize deployments (web/api/docs)

[kuyacarlo]

Parent: #14 (MVP epic) — also cross-cuts ops

Bottom line

Centralize WorkSight deployments (web / api / docs) into one compose-or-platform contract with a single env/secrets story, instead of split apps/*/vercel.json + docker-compose.yml + doc/DEPLOYMENT.md drift.

Current state

• apps/web/vercel.json, apps/api/vercel.json
• Root docker-compose.yml + nginx/
• doc/DEPLOYMENT.md may be stale vs pnpm/Nest/Next 15

Done means

• One primary local path (docker compose up or documented turbo/pnpm)
• One primary remote path (Vercel monorepo or compose/Fly — pick one SoT, document the other as optional)
• Env matrix (.env.example at root) covering web + api + supabase
• CI path-filtered builds for web/api/docs
• doc/DEPLOYMENT.md + README match reality
• Handoff with verify commands

Non-goals

• Live connector deploys (Jira/Odoo/etc.)
• Multi-tenant prod hardening

[kuyacarlo]

Handoff: https://github.com/4sightorg/worksight/blob/docs/mvp-handoffs/docs/handoffs/2026-07-25-centralize-deployments.md

[kuyacarlo]

Vercel monorepo settings applied (2026-07-25)

Canonical projects now share 4sightorg/worksight and production branch canary:

Project	Root	Build
worksight	apps/web	pnpm --filter @worksight/web build
worksight-api	apps/api	pnpm --filter @worksight/api build
worksight-docs	apps/docs	pnpm --filter @worksight/docs build

All use pnpm install --frozen-lockfile, can read workspace files outside their Root Directory, and have affected-project deployments enabled. worksight-dev.vercel.app remains mapped to dev; production is canary.

PR #21 preview checks passed for all canonical Vercel projects. Legacy duplicate Vercel projects were not deleted pending URL/domain verification.

[kuyacarlo]

Repo-side config landed in #23 (stacked on #21).

Committed configs now match the applied dashboard settings for all three projects:

Project	Root Directory	Build
worksight	apps/web	pnpm --filter @worksight/web build
worksight-api	apps/api	pnpm --filter @worksight/api build
worksight-docs	apps/docs	pnpm --filter @worksight/docs build

All three: pnpm install --frozen-lockfile, production branch canary, source files outside Root Directory enabled, skip-unaffected-project deploys enabled.

Two real defects fixed along the way: the API's legacy builds/routes block was disabling Vercel's install and build steps entirely, and the Supabase anon key was hardcoded in vercel.json.

Still open: the API has no serverless handler (main.ts calls app.listen()), so Docker remains its only working deploy path.