build: switch to native Hugo TailwindCSS pipeline, align Dockerfile with pivoine.art

Replaces the PostCSS + autoprefixer toolchain with Hugo's native
css.TailwindCSS pipe (via @tailwindcss/cli), matching the setup already
in use on pivoine.art. Dockerfile now builds on hugomods/hugo with a
matched Hugo/Node version instead of manually installing Hugo onto
node:22-alpine.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3xLyuoN6uzfCYBo8kVoSn

Dockerfile

@@ -1,25 +1,20 @@
 # ── Stage 1: builder ────────────────────────────────────────────────────────
-FROM node:22-alpine AS builder
-
-# Install Hugo extended + build tools
-RUN apk add --no-cache \
-    curl \
-    git \
-    libc6-compat \
-    && HUGO_VERSION=0.147.2 \
-    && curl -sSL "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz" \
-    | tar -xz -C /usr/local/bin hugo
+# hugomods image bundles Hugo Extended + Node at matching, tested versions —
+# Hugo's css.TailwindCSS execs node_modules/.bin/tailwindcss during the build,
+# and pnpm-workspace.yaml's preferSymlinkedExecutables makes that a plain
+# symlink Hugo's exec-security check accepts (see layouts/partials/head.html).
+FROM hugomods/hugo:debian-node-0.165.0 AS builder
 
 # Install pnpm
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN npm install -g pnpm
 
 WORKDIR /app
 
-# Install dependencies
-COPY package.json pnpm-lock.yaml* ./
+# Copy package files first (for layer caching)
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile
 
-# Copy source
+# Copy source files
 COPY . .
 
 # Build site