ci(web): fix permission errors publishing to stable APP_DIR (docker chown+chmod, exclude .pnpm-store); runtime: use container-local PNPM store to avoid host writes

stack.yml

@@ -14,6 +14,7 @@ services:
       - sistema_db:/app/data
     environment:
       NODE_ENV: "production"
+      PNPM_STORE_DIR: "/tmp/pnpm-store"
       # Garante instalação de devDependencies para o build (prisma CLI)
       NPM_CONFIG_PRODUCTION: "false"
       # IMPORTANTE: "NEXT_PUBLIC_*" é consumida pelo navegador (cliente). Use a URL pública do Convex.