Fix ai-service Dockerfile: bake in drug_entities.json, override its path

infra/docker/docker-compose.prod.yml

@@ -0,0 +1,58 @@
+# Production topology for a single EC2 box. No GPU, no team k3s — Bedrock
+# calls go out over the instance's IAM role (see coordination/WORK_SPLIT_
+# 2026-08-10.md), so no AWS access keys live in this file or its env files.
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: duoc_thu
+      POSTGRES_PASSWORD: duoc_thu
+      POSTGRES_DB: duoc_thu
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    restart: unless-stopped
+
+  qdrant:
+    image: qdrant/qdrant:latest
+    volumes:
+      - qdrant-data:/qdrant/storage
+    restart: unless-stopped
+
+  ai-service:
+    build:
+      context: ../..
+      dockerfile: apps/ai-service/Dockerfile
+    env_file: ../../apps/ai-service/.env.prod
+    depends_on:
+      - postgres
+      - qdrant
+    restart: unless-stopped
+
+  web:
+    build:
+      context: ../..
+      dockerfile: apps/web/Dockerfile
+    environment:
+      AI_SERVICE_URL: http://ai-service:8000
+    depends_on:
+      - ai-service
+    restart: unless-stopped
+
+  caddy:
+    image: caddy:2-alpine
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+    depends_on:
+      - web
+    restart: unless-stopped
+
+volumes:
+  postgres-data:
+  qdrant-data:
+  caddy-data:
+  caddy-config: