Fix: grant nextjs user write access to .next/cache

[crarau]

Root Cause

The Next.js Image Optimization cache writes to /app/.next/cache at runtime. In the multi-stage Dockerfile, the .next/ directory is created by COPY --from=builder and is owned by root. After switching to USER nextjs, the process cannot create the cache subdirectory, resulting in EACCES: permission denied errors.

Fix

Added RUN mkdir -p .next/cache && chown nextjs:nodejs .next/cache before the USER nextjs directive. This pre-creates the cache directory with correct ownership so the non-root user can write to it at runtime.

Alert Reference

Triggered by production alert at 2026-04-21T01:30:03.953Z — 3 EACCES errors in 5 minutes on c3-marketing.

Testing

• All 158 unit/integration tests pass (npm test)
• This is a standard Next.js Docker pattern fix (ref: Next.js docs on Docker deployment)
• No unit test for filesystem permissions is feasible without a Docker build; the fix is a one-line well-established pattern