CI/CD + deploy: Gitea Actions -> registry -> Dockge -> NPM (rcai.brasse-pc.eu)

Server:
- serverar byggd web-frontend statiskt + SPA-fallback (WEB_DIST)
- host-mountad persistent katalog via DATA_DIR (/srv/docker/agent-helm -> /app/data),
  förberedd för framtida db/auth enligt övriga appars konvention
- esbuild-bundle -> dist/server.cjs (en fil, inga node_modules i runtime)
Web:
- WS-URL defaultar till samma origin i prod (wss://rcai.brasse-pc.eu), localhost i dev

Deploy-artefakter:
- Dockerfile: multi-stage, bygger web + bundlar server; --filter utesluter daemon
  (ingen node-pty-kompilering); kör som uid 1000 (= brasse på host)
- .gitea/workflows/build.yaml: push master -> bygg arm64 -> push localhost:5000
- deploy/act-runner.{compose,config}.yaml: Gitea Actions-runner i Docker (docker.sock,
  job-containrar får värdens docker for build/push)
- deploy/agent-helm.compose.yaml: Dockge-stack (srv_default, expose 8787, data-mount,
  x-dockge.urls)
- deploy/DEPLOY.md: full runbook (runner, bygge, stack, NPM, uppdatering, felsökning)

Verifierat lokalt: typecheck rent, server-bundle serverar UI+health+assets+SPA-fallback,
data-dir skapas. Docker-bygget validerat så långt daemonen är nere (filter bekräftat).

Dockerfile

@@ -0,0 +1,40 @@
+# syntax=docker/dockerfile:1
+#
+# agent-helm control-plane + web-UI i en enda image.
+# Byggs av Gitea Actions PÅ Pi5 (arm64) och pushas till localhost:5000.
+# Servern serverar den byggda Vue-frontenden statiskt + WebSocket på samma port.
+
+# ---------- builder ----------
+FROM node:22-slim AS builder
+WORKDIR /app
+RUN npm install -g pnpm@11.3.0
+
+# Installera bara det server + web behöver. "..."-suffixet tar med workspace-
+# beroenden (shared) men UTESLUTER daemon -> ingen node-pty-kompilering här.
+COPY pnpm-workspace.yaml package.json pnpm-lock.yaml .npmrc ./
+COPY packages/shared/package.json ./packages/shared/
+COPY packages/server/package.json ./packages/server/
+COPY packages/web/package.json ./packages/web/
+COPY packages/daemon/package.json ./packages/daemon/
+RUN pnpm install --frozen-lockfile \
+      --filter "@agent-helm/server..." \
+      --filter "@agent-helm/web..."
+
+# Källkod + bygg (web -> dist, server -> en bundlad cjs-fil)
+COPY packages/shared ./packages/shared
+COPY packages/server ./packages/server
+COPY packages/web ./packages/web
+RUN pnpm --filter @agent-helm/web build \
+ && pnpm --filter @agent-helm/server bundle
+
+# ---------- runtime ----------
+FROM node:22-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production \
+    PORT=8787 \
+    WEB_DIST=/app/web
+COPY --from=builder /app/packages/server/dist/server.cjs ./server.cjs
+COPY --from=builder /app/packages/web/dist ./web
+EXPOSE 8787
+USER node
+CMD ["node", "server.cjs"]