fix(deploy): pin SSL_CERT_FILE/SSL_CERT_DIR for sentry-cli on Alpine

ca-certificates alone didn't fully resolve sentry-cli's TLS handshake
against GlitchTip in the Docker builder stage -- explicitly pointing its
vendored OpenSSL at the installed CA bundle location is the documented
workaround for this class of Rust-binary-on-Alpine cert issue.

docker/Dockerfile

@@ -15,10 +15,13 @@ FROM node:22-alpine AS builder
 WORKDIR /app
 
 # sentry-cli (invoked by withSentryConfig during `npm run build` to upload
-# source maps) is a Rust binary that needs the system CA bundle to validate
-# GlitchTip's TLS cert — Alpine ships without one, causing "unable to get
-# local issuer certificate" and a failed upload.
+# source maps) is a Rust binary whose vendored OpenSSL doesn't reliably
+# autodetect Alpine's CA bundle location, causing "unable to get local
+# issuer certificate" against GlitchTip's TLS cert. Install the bundle and
+# point SSL_CERT_FILE/SSL_CERT_DIR at it explicitly.
 RUN apk add --no-cache ca-certificates
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+ENV SSL_CERT_DIR=/etc/ssl/certs
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .