Add tested standalone distroless Flood variant

Dockerfile.distroless

@@ -0,0 +1,27 @@
+# Alpine-built binaries and musl stay together; no shell/package manager in final image.
+ARG NODE_IMAGE=docker.io/node:24.18.1-alpine3.24
+FROM ${NODE_IMAGE} AS nodebuild
+WORKDIR /usr/src/app
+COPY . ./
+RUN npm install -g corepack && corepack enable && corepack install \
+    && pnpm install --frozen-lockfile
+RUN npm run build
+
+FROM ${NODE_IMAGE} AS runtime
+RUN apk add --no-cache mediainfo coreutils ca-certificates tzdata \
+    lddtreepax python3
+COPY .ci-runtime-root.py /build/runtime-root.py
+RUN python3 /build/runtime-root.py /runtime /usr/local/bin/node \
+    /usr/bin/mediainfo "$(command -v df)"
+COPY --from=nodebuild /usr/src/app/dist /runtime/usr/src/app/dist
+COPY --from=nodebuild /usr/src/app/package.json /runtime/usr/src/app/package.json
+COPY --from=nodebuild /usr/src/app/LICENSE /runtime/usr/src/app/LICENSE
+
+FROM scratch
+COPY --from=runtime /runtime/ /
+ENV NODE_ENV=production HOME=/root PATH=/usr/local/bin:/usr/bin:/bin
+WORKDIR /usr/src/app
+RUN --mount=type=bind,from=nodebuild,source=/usr/src/app/.ci-startup-distroless.cjs,target=/ci-startup.cjs ["/usr/local/bin/node", "/ci-startup.cjs"]
+VOLUME ["/server/db"]
+EXPOSE 3000
+ENTRYPOINT ["/usr/local/bin/node", "--enable-source-maps", "--use_strict", "dist/index.js", "--host=0.0.0.0", "--rundir=/server/"]