Add ERPNext Dockerfile + build script for automated security rebuilds

- erpnext/Dockerfile: builds from frappe/erpnext:v15 base with custom apps
- erpnext/build.sh: stages custom apps into build context before docker build
- Container update script now runs build.sh pre-build + extracts assets post-build
- ERPNext will auto-rebuild nightly when base image has security patches

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

erpnext/Dockerfile

@@ -0,0 +1,28 @@
+# Performance West ERPNext — custom image with PW apps baked in.
+# Base: official Frappe bench image (includes ERPNext).
+# Custom apps: performancewest_erpnext, frappe_ca_registry, frappe_crypto, frappe_adyen
+#
+# Pre-build step copies apps into erpnext/ dir (see erpnext/build.sh).
+# Rebuilt nightly by pw-container-update to pick up base image security patches.
+
+FROM frappe/erpnext:v15
+
+USER frappe
+WORKDIR /home/frappe/frappe-bench
+
+# Copy custom Frappe apps (staged into build context by build.sh)
+COPY --chown=frappe:frappe frappe_crypto/ apps/frappe_crypto/
+COPY --chown=frappe:frappe frappe_adyen/ apps/frappe_adyen/
+COPY --chown=frappe:frappe frappe_ca_registry/ apps/frappe_ca_registry/
+COPY --chown=frappe:frappe performancewest_erpnext/ apps/performancewest_erpnext/
+
+# Install the payments app (not in base image) + all custom apps
+RUN git clone --depth=1 https://github.com/frappe/payments.git apps/payments \
+    && env/bin/pip install --quiet -e apps/payments \
+    && env/bin/pip install --quiet -e apps/frappe_crypto \
+    && env/bin/pip install --quiet -e apps/frappe_adyen \
+    && env/bin/pip install --quiet -e apps/frappe_ca_registry \
+    && env/bin/pip install --quiet -e apps/performancewest_erpnext
+
+# Build JS/CSS assets
+RUN bench build --app payments 2>/dev/null || true