fix: use absolute paths and static linking in Dockerfile

The container failed to start with 'exec ./webhooker: no such file or
directory'. Two issues:

1. Relative paths: COPY destination and CMD used relative paths (./webhooker).
   Changed to absolute paths (/app/webhooker) throughout.

2. Dynamic linking: The binary was built with CGO on Debian (glibc) but
   deployed to Alpine (musl). The kernel couldn't find the glibc dynamic
   linker, producing the misleading 'no such file or directory' error.
   Added a static rebuild step after make check so the binary runs on
   Alpine without glibc.

Dockerfile

@@ -42,6 +42,13 @@ COPY . .
 # Run all checks (fmt-check, lint, test, build)
 RUN make check
 
+# Rebuild with static linking for Alpine runtime.
+# make check already verified formatting, linting, tests, and compilation.
+# The CGO binary from `make build` is dynamically linked against glibc,
+# which doesn't exist on Alpine (musl). Rebuild with static linking so
+# the binary runs on Alpine without glibc.
+RUN CGO_ENABLED=1 go build -ldflags '-extldflags "-static"' -o bin/webhooker ./cmd/webhooker
+
 # alpine:3.21 — 2026-03-01
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 
@@ -54,7 +61,7 @@ RUN addgroup -g 1000 -S webhooker && \
 WORKDIR /app
 
 # Copy binary from builder
-COPY --from=builder /build/bin/webhooker .
+COPY --from=builder /build/bin/webhooker /app/webhooker
 
 # Create data directory for all SQLite databases (main app DB +
 # per-webhook event DBs). DATA_DIR defaults to /data in production.
@@ -69,4 +76,4 @@ EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
     CMD wget --no-verbose --tries=1 --spider http://localhost:8080/.well-known/healthcheck || exit 1
 
-CMD ["./webhooker"]
+CMD ["/app/webhooker"]