refactor: Enhance all Dockerfiles with security hardening, optimization, and production best practices

- Add maintainer and description labels to all build and runtime stages
- Change builder WORKDIR from /app to /build for clarity
- Install build dependencies with --no-cache/--no-install-recommends flags
- Add build optimizations: -ldflags="-w -s -extldflags '-static'" and -trimpath for Go, strip for Rust
- Implement dependency caching strategy for Rust builds (dummy app pattern)
- Pin Alpine base

deployments/docker/cli.Dockerfile

@@ -1,20 +1,53 @@
+# Build stage
 FROM golang:1.26-alpine AS builder
 
-WORKDIR /app
+LABEL maintainer="nutcas3 <[email protected]>" \
+      description="CLI for Telecom Platform"
 
+WORKDIR /build
+
+# Install build dependencies
+RUN apk add --no-cache git ca-certificates
+
+# Copy dependency files
 COPY apps/cli/go.mod apps/cli/go.sum ./
 RUN go mod download
 
+# Copy source code
 COPY apps/cli/ ./
 
-RUN CGO_ENABLED=0 GOOS=linux go build -o cli .
+# Build with optimizations
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
+    -ldflags="-w -s -extldflags '-static'" \
+    -trimpath \
+    -o telecom-cli .
 
-FROM alpine:latest
+# Runtime stage
+FROM alpine:3.20
 
-RUN apk --no-cache add ca-certificates
+LABEL maintainer="nutcas3 <[email protected]>" \
+      description="CLI for Telecom Platform" \
+      version="1.0.0"
 
-WORKDIR /root/
+# Install runtime dependencies
+RUN apk add --no-cache ca-certificates tzdata
 
-COPY --from=builder /app/cli .
+# Create non-root user
+RUN addgroup -g 1000 appuser && \
+    adduser -D -u 1000 -G appuser appuser
 
-CMD ["./cli"]
+WORKDIR /app
+
+# Copy binary from builder
+COPY --from=builder /build/telecom-cli .
+
+# Change ownership
+RUN chown -R appuser:appuser /app
+
+# Switch to non-root user
+USER appuser
+
+# Signal handling
+STOPSIGNAL SIGTERM
+
+CMD ["./telecom-cli"]