add puppeteer support

apps/edr-freight-api/Dockerfile

@@ -2,7 +2,27 @@
 # Build from monorepo root: docker build -f apps/edr-freight-api/Dockerfile .
 
 FROM node:24.15.0-alpine AS base
-RUN apk add --no-cache libc6-compat
+
+# Puppeteer ships a glibc Chrome that cannot run on Alpine; skip the ~150MB
+# download at install time. The runner stage installs Alpine's system Chromium.
+ENV PUPPETEER_SKIP_DOWNLOAD=true
+# Chromium + fonts for Puppeteer PDF rendering (contract/invoice/receipt docs).
+# Without these, Puppeteer fails to launch and the code degrades to an
+# unformatted plain-text PDF fallback. Use Alpine's system Chromium (musl-built);
+# the glibc Chrome that `puppeteer install` downloads cannot run on Alpine.
+RUN apk add --no-cache \
+    libc6-compat \
+    chromium \
+    nss \
+    freetype \
+    harfbuzz \
+    ca-certificates \
+    ttf-freefont \
+    font-noto-cjk
+ENV NODE_ENV=production
+# Point Puppeteer at the system Chromium and skip its bundled download.
+ENV PUPPETEER_SKIP_DOWNLOAD=true
+ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
 # Store pnpm's content-addressable store under PNPM_HOME so the BuildKit
 # `--mount=type=cache,target=/pnpm/store` cache actually persists deps across builds.
 ENV PNPM_HOME="/pnpm"
@@ -31,8 +51,8 @@ COPY --from=builder /app/ .
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     pnpm deploy --filter="@edr/freight-api" --prod --legacy /deploy
 
-FROM node:24.15.0-alpine AS runner
-RUN apk add --no-cache libc6-compat
+FROM base AS runner
+
 ENV NODE_ENV=production
 WORKDIR /app
 RUN addgroup --system --gid 1001 nodejs \