feat(deploy): Docker images for server (API+SPA) and vision + branch-aware build pipeline

Containerize the two non-desktop apps for the booth appliance. The desktop app stays
on its own tag-only release.yml.

- apps/server/Dockerfile: multi-stage node:22-alpine. `pnpm deploy --legacy --prod`
  (NOT prune — the monorepo native better-sqlite3 won't resolve under a root prune)
  yields a self-contained bundle; build stage adds node-gyp toolchain, runtime adds
  libstdc++; non-root, healthcheck. Migrates the mounted DB on boot via a drizzle-kit-
  free runtime migrator (packages/db/scripts/migrate-runtime.mjs) — drizzle-kit is a
  devDep, pruned from prod.
- apps/server/src/static-spa.ts: Fastify serves the built React SPA (one container
  serves API + UI). GET-only fallback to index.html, excludes /api + /health so it never
  shadows the backend; a no-op in dev (no dist). Registered last in server.ts.
- apps/vision/Dockerfile: uv base, --extra alpr, model weights PRE-WARMED into the image
  as the runtime user so fast_alpr boots offline (0 downloads at runtime). Engine env-
  selected (VISION_RECOGNIZER stub|fast_alpr).
- Branch-aware: docker-compose.yml (base) + .dev.yml (build local, stub, ports) +
  .prod.yml (pull pinned, fast_alpr, vision internal, restart always); REGISTRY/TAG from
  env so a branch deploy pulls that branch's image.
- .gitea/workflows/build-images.yml: on push to dev/main, run the full turbo build+lint+
  test gate, then buildx push both images to git.infra.msai.al/mca/parking_solution with
  branch + branch-<sha> tags (registry cache; optional Komodo webhook behind KOMODO_ENABLED).
- .dockerignore excludes **/parking.sqlite* so the signed ledger is NEVER baked.

Verified locally (Docker 29): server image migrates + serves API+SPA (/health 200, /
+ /booth HTML, /api/nope JSON 404, no sqlite outside /data); vision image boots fast_alpr
with 0 runtime downloads; compose stack healthy with server→vision over the private network.

Wiki: new container-deployment.md; vision-service-packaging open Qs resolved; index + log.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -1463,3 +1463,24 @@ classified via event-detail.tsx isRefusedWarning and shown as amber REFUZUAR/REF
 ANOMALI for genuine red-flags. No ledger change → historical events reclassify too. New reason code
 void.ticketCancelled (shared + both web catalogs). Tests: void-flow.test.ts (8) + occupancy void fold;
 141 server + 87 shared green; build+lint (TS + i18n parity) green. Updated [[parking-session]].
+
+## [2026-06-22] build | Docker images for non-desktop apps (server+SPA, vision) + branch-aware build pipeline
+Containerized the two runtime apps. parking-server = Fastify API + the bundled React SPA (wired
+@fastify/static in new static-spa.ts — serves apps/web/dist with an SPA index.html fallback, GET-only
+and excluding /api + /health so it never shadows the backend; a NO-OP in dev where no dist exists).
+parking-vision = the Python/uv ANPR service, ships --extra alpr with model weights pre-warmed into the
+image (offline-first), engine env-selected (VISION_RECOGNIZER stub|fast_alpr). Branch-aware per the
+user: images tagged branch + branch-<sha>; base docker-compose.yml + docker-compose.dev.yml (build
+local, stub, ports) / docker-compose.prod.yml (pull pinned, fast_alpr, vision internal, restart
+always). New .gitea/workflows/build-images.yml pushes both to git.infra.msai.al/mca/parking_solution
+on push to dev/main, after a full turbo build+lint+test gate (mirrors trm/processor; optional Komodo
+webhook behind KOMODO_ENABLED). KEY build lessons: use `pnpm deploy --legacy --prod` NOT
+`pnpm prune` (monorepo: prune leaves the native better-sqlite3 unresolved); Alpine needs
+python3/make/g++ (build) + libstdc++ (runtime); set CI=true so pnpm wipes node_modules; migrate at
+BOOT via a drizzle-kit-free runtime migrator (packages/db/scripts/migrate-runtime.mjs) against the
+mounted /data volume; .dockerignore must exclude **/parking.sqlite* (deploy ignores .gitignore) so the
+signed ledger is NEVER baked. JWT_SECRET must be a real >=32-char value (auth.ts rejects dev-only/
+insecure/change-me). VERIFIED: server image builds + runs — migrates, SPA serving on, /health 200,
+/ + /booth serve HTML, /api/nope JSON 404, no sqlite outside /data. Vision image build + smoke in
+progress. New page [[container-deployment]]; updated [[vision-service-packaging]] (resolved its two
+open Qs), index. Server tests stay 141 green (SPA serving guarded on dist existence).