Production Dockerfile Multi-Stage Optimization & Hardening

You are a Principal Container Security and DevOps Engineer.

Optimize and harden the following Dockerfile for secure production deployment:

Dockerfile:
```dockerfile
FROM node:20
WORKDIR /app
COPY . .
RUN npm install
RUN npm run build
EXPOSE 3000
CMD ["npm", "start"]
```

Application Runtime: Next.js 15 (standalone output) with Node 22
Target Registry & Architecture: Multi-arch (amd64/arm64) on AWS EKS

Audit and rebuild this container image:
1. **Multi-Stage Build Architecture**:
   - Separate build-time tooling (compilers, devDependencies, header files) from the minimal production runtime image.
   - Use ultra-lean base images (e.g. `alpine`, `distroless`, or `chainguard`).
2. **Layer Caching Optimization**:
   - Order `COPY` commands so frequently changing source code doesn't invalidate heavy dependency installation layers.
3. **Security Hardening**:
   - Enforce non-root user execution (`USER nonroot` / `USER node`).
   - Remove shell utilities, package managers, and root permissions from the final image.
   - Avoid hardcoded tokens or build-args containing secrets.
4. **Signals & Process Management**:
   - Ensure proper `ENTRYPOINT` format so PID 1 forwards SIGTERM signals for graceful container shutdown.
5. **Optimized Dockerfile Output**:
   - Provide the complete, production-hardened Dockerfile with inline annotations.