fix(ipsec): восстановить mode-config с проверкой зависимостей

backend/Dockerfile

@@ -37,6 +37,15 @@ RUN npm run build -w @mmapp/contracts \
 
 FROM node:22-bookworm-slim AS runner
 WORKDIR /app
+# Keep system packages independent of application changes and version tags.
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends gnupg wget ca-certificates \
+  && wget -qO- https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor -o /usr/share/keyrings/pgdg.gpg \
+  && echo "deb [signed-by=/usr/share/keyrings/pgdg.gpg] http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends postgresql-client-18 \
+  && rm -rf /var/lib/apt/lists/* \
+  && mkdir -p /app/data
 ARG APP_VERSION=dev
 ENV NODE_ENV=production
 ENV PORT=8000
@@ -50,13 +59,5 @@ COPY --from=build /app/backend/package.json ./backend/package.json
 COPY --from=build /app/backend/drizzle ./backend/drizzle
 # Nested install from lockfile (dotenv etc.) — ESM resolves from /app/backend/dist → ../node_modules
 COPY --from=build /app/backend/node_modules ./backend/node_modules
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends gnupg wget ca-certificates \
-  && wget -qO- https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor -o /usr/share/keyrings/pgdg.gpg \
-  && echo "deb [signed-by=/usr/share/keyrings/pgdg.gpg] http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends postgresql-client-18 \
-  && rm -rf /var/lib/apt/lists/* \
-  && mkdir -p /app/data
 EXPOSE 8000
 CMD ["node", "backend/dist/index.js"]