fix: bake Chromium browser into combined image

The Dockerfile's builder stage runs 'playwright install chromium' which
downloads Chromium, but the runtime stage never copies the browser cache.
When the scanner service (python -m src.worker) tries to launch Playwright,
it crashes with 'Executable doesn't exist at /root/.cache/ms-playwright/...'

Copy the Playwright browser cache from the builder stage, set
PLAYWRIGHT_BROWSERS_PATH so Playwright finds it, and add the shared
libraries Chromium needs (libnss3, libgbm, etc.).

Dockerfile

@@ -39,11 +39,19 @@ WORKDIR /app
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     libpq5 postgresql-client curl tini supervisor nginx \
+    libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdbus-1-3 \
+    libdrm2 libgbm1 libgtk-3-0 libnspr4 libxcomposite1 libxdamage1 \
+    libxfixes3 libxrandr2 libxshmfence1 libpango-1.0-0 libcairo2 \
+    libasound2 libatspi2.0-0 libx11-xcb1 fonts-liberation \
     && rm -rf /var/lib/apt/lists/* \
     && apt-get clean
 
-# Copy Python deps from builder
+# Copy Python deps and Playwright/Chromium browser from builder
 COPY --from=builder /install /usr/local
+COPY --from=builder /root/.cache/ms-playwright /root/.cache/ms-playwright
+
+# Tell Playwright where to find Chromium (baked from builder)
+ENV PLAYWRIGHT_BROWSERS_PATH=/root/.cache/ms-playwright
 
 # Copy application code
 COPY apps/api/src ./src