fix(build): copy the settings contract into the container build context

Both Dockerfiles copy cmd/, internal/, migrations/ and web/embed.go, but the
manifest lives in contracts/settings/v1 — an embedded Go package that sits
outside internal/ because clients vendor those files. The image build therefore
fails with "no required module provides package .../contracts/settings/v1".

Caught deploying to the dev box. Nothing had built an image since the manifest
landed: the Docker workflow only runs on pushes to main and workflow_dispatch,
and CI's go build runs against a full checkout, so neither gate covers the
container context. This would have broken the published image on merge.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -32,6 +32,10 @@ COPY --from=frontend_dist / web/dist
 COPY cmd/ cmd/
 COPY internal/ internal/
 COPY migrations/ migrations/
+# The settings contract is a Go package (contracts/settings/v1) that embeds the
+# manifest, so the binary carries the exact bytes it was built from. It lives
+# outside internal/ because clients vendor these files.
+COPY contracts/ contracts/
 ARG BUILD_REVISION
 ARG BUILD_DIRTY=false
 RUN --mount=type=cache,target=/root/.cache/go-build \

Dockerfile.dev

@@ -29,6 +29,9 @@ COPY --from=frontend /app/web/dist web/dist
 COPY cmd/ cmd/
 COPY internal/ internal/
 COPY migrations/ migrations/
+# See Dockerfile: the settings contract is an embedded Go package outside
+# internal/, so the build fails without it.
+COPY contracts/ contracts/
 
 # Stage 3: Build Go binary for dev using a local plugin SDK checkout passed via
 # BuildKit named context `silo_plugin_sdk`.