feat: team module, multi-stage Dockerfile, doctor utils, AI config overhaul

- Team module: POST /api/team/members (in-place employee creation with
  temp password + Redis cache), PUT /api/team/members/:id, GET temp
  password endpoint. Uses signUpInWorkspace — no email invites.
- Dockerfile: rewritten as multi-stage build (builder + runtime) so
  native modules compile for target arch. Fixes darwin→linux crash.
- .dockerignore: exclude dist, node_modules, .env, .git, data/
- package-lock.json: regenerated against public npmjs.org (was
  pointing at localhost:4873 Verdaccio — broke docker builds)
- Doctor utils: shared DOCTOR_VISIT_SLOTS_FRAGMENT + normalizeDoctors
  helper for visit-slot-aware queries across 6 consumers
- AI config: full admin CRUD (GET/PUT/POST reset), workspace-scoped
  setup-state with workspace ID isolation, AI prompt defaults overhaul
- Agent config: camelCase field fix for SDK-synced workspaces
- Session service: workspace-scoped Redis key prefixing for setup state
- Recordings/supervisor/widget services: updated to use doctor-utils
  shared fragments instead of inline visitingHours queries

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/team/team.controller.ts

@@ -0,0 +1,39 @@
+import { Body, Controller, Get, Param, Post, Put } from '@nestjs/common';
+import {
+    TeamService,
+    type CreateMemberInput,
+    type CreatedMember,
+    type UpdateMemberInput,
+} from './team.service';
+
+// REST wrapper around TeamService. Mounted at /api/team/*.
+// The Team wizard step on the frontend posts here instead of firing
+// the platform's sendInvitations mutation directly.
+
+@Controller('api/team')
+export class TeamController {
+    constructor(private team: TeamService) {}
+
+    @Post('members')
+    async createMember(@Body() body: CreateMemberInput): Promise<CreatedMember> {
+        return this.team.createMember(body);
+    }
+
+    @Put('members/:id')
+    async updateMember(
+        @Param('id') id: string,
+        @Body() body: UpdateMemberInput,
+    ): Promise<{ id: string }> {
+        return this.team.updateMember(id, body);
+    }
+
+    // Returns the cached plaintext temp password for a recently-created
+    // member if it's still within its 24h TTL, or { password: null }
+    // on cache miss. Used by the wizard's right-pane copy icon when
+    // its in-browser memory was wiped by a refresh.
+    @Get('members/:id/temp-password')
+    async getTempPassword(@Param('id') id: string): Promise<{ password: string | null }> {
+        const password = await this.team.getTempPassword(id);
+        return { password };
+    }
+}