feat: Souq native integration + auth simplification + CE-wide enhancements

Souq Marketplace:
- Native souq pages: browse+filters, create listing, detail+seller profile, orders+chat
- New API: reviews (POST), sellers/[id], upload (multipart), polar-checkout webhook
- Listings API enhanced: minPrice, maxPrice, sortBy, deliveryDays filters
- Seller workflow: start order, mark delivered, upload files, confirm delivery
- Wallet: 5 Polar.sh FLH tiers, production checkout, mock fallback, success banner
- Fix: order redirect /souq/history → /souq/orders

Auth System:
- Unified auth page, removed OAuth provider routing (2 files deleted)
- Deleted oauth.ts (319 lines) — simplified auth chain
- Streamlined login/register API routes

Prisma Schema (+179 lines):
- New models: Listing, Purchase, Review, Group/GroupMember
- Gamification: DailyStreak, XpTransaction, Achievement, UserLevel
- Learning: LearnCourse/Module/Enrollment/Certificate
- Notifications, Referrals, Dhikr, PremiumBenefits

Deleted legacy code:
- src/app/api/marketplace/* (3 files) — replaced by /api/souq/*
- src/app/api/files/[listingId]/route.ts — replaced by /api/souq/upload
- src/app/api/seller/[sellerId]/route.ts — replaced by /api/souq/sellers/[id]

Infrastructure:
- Dockerfile: standalone output, Prisma runtime migration
- docker-compose.yml: Polar env vars, healthcheck fix
- docker-compose.staging.yml: staging on port 4014
- .gitea/workflows/ci.yml: CI pipeline

Dockerfile

@@ -1,3 +1,9 @@
+# ── Falah Mobile — Production Dockerfile ──────────────────────────────
+# Requires npm run build to be run first on the host (Next.js standalone)
+# Build sequence:
+#   cd /app && npm ci && npm run build
+#   docker build -t falah-mobile:latest .
+
 FROM node:20-alpine
 
 RUN apk add --no-cache openssl ca-certificates curl
@@ -10,13 +16,14 @@ RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 nextjs
 COPY .next/standalone/falah-mobile ./
 COPY .next/static ./.next/static
 COPY public ./public
-COPY prisma/schema.prisma ./prisma/schema.prisma
+
+# Copy prisma CLI and schema for runtime migrations
+COPY node_modules/prisma ./node_modules/prisma
+COPY node_modules/.prisma/client ./node_modules/.prisma/client
+COPY node_modules/@prisma ./node_modules/@prisma
+COPY prisma ./prisma
 
 # Fix Turbopack's hashed Prisma client path
-# Turbopack resolves @prisma/client to @prisma/client-<hash> but the
-# build-time symlink points to a path that doesn't exist in Docker.
-# We copy the existing @prisma/client to the hash name so Node.js
-# can resolve it when the Turbopack runtime requires it.
 RUN if [ -d ".next/node_modules/@prisma" ]; then \
       for d in .next/node_modules/@prisma/client-*; do \
         name=$(basename "$d"); \
@@ -25,7 +32,16 @@ RUN if [ -d ".next/node_modules/@prisma" ]; then \
       done; \
     fi
 
-RUN mkdir -p /app/data
+RUN mkdir -p /app/data && chown nextjs:nodejs /app/data
+
+# Fix permissions so nextjs user can run prisma CLI and read schema
+RUN chown -R nextjs:nodejs /app/node_modules/@prisma /app/node_modules/prisma /app/node_modules/.prisma /app/prisma 2>/dev/null || true
+
+# Startup script — migrate volumes DB then launch server
+RUN printf '#!/bin/sh\n\
+cd /app\n\
+node ./node_modules/prisma/build/index.js db push --skip-generate 2>&1\n\
+exec node server.js\n' > /app/start.sh && chmod +x /app/start.sh
 
 USER nextjs
 EXPOSE 3000
@@ -33,4 +49,4 @@ EXPOSE 3000
 ENV NODE_ENV=production
 ENV DATABASE_URL="file:/app/data/dev.db"
 
-CMD ["node", "server.js"]
+CMD ["/app/start.sh"]