harden(deploy): apply safe fixes from review report-only items

- #3 Liveness probe targets full SSR DB-querying / route, coupling pod liveness to SQLite
- #4 Chart values-staging/production.yaml are dead config under Flux; drift trap
- #6 tsconfig includes gitignored emdash-env.d.ts that only the dev server generates
- #7 Dockerfile package-lock glob + npm install fallback can silently build an unlocked image
- #8 Dockerfile creates runtime user without pinning its GID
- #9 entrypoint.sh gates `emdash init` on data.db absence, skipping migrations on PVC reuse
- #10 pullPolicy: Always vs digest pinning
- #11 Dockerfile state symlinks contradict the STATE_DIR contract; Dockerfile does not set ENV STATE_DIR
- #12 astro is a production dependency, so npm prune --omit=dev keeps build-only tooling
- #14 Two ImageUpdateAutomations write back to the same anton-helm-workloads main branch
- #16 memoryCache provider is per-process; correctness depends implicitly on replicas:1
- #17 Root catch-all [slug].astro couples nav links to pages-collection rows + DB hit per unmatched path
- #18 Detail pages render a 200-style body under a 404 status and have no try/catch around getEmDash* calls
- #19 vite allowedHosts hardcodes ddev hostnames (dev-only; no prod impact)

ARCHITECTURE.md

@@ -66,13 +66,26 @@ the matching branch of this repo. The `ignore` rule in `source.yaml`
 restricts reconciliation to `/deploy/helm`, so app-source pushes don't
 trigger chart re-reconcile.
 
-Per-env values overlay `values.yaml` via `values-staging.yaml` /
-`values-production.yaml` (for `helm upgrade` direct use) and via the
-`values:` block in the FluxCD `HelmRelease`.
+Per-env values come from **two independent sources** that must be kept in
+sync by hand:
+
+- The inline `values:` block in each FluxCD `HelmRelease` (in
+  `anton-helm-workloads`, templated under `deploy/fleet-overlay/`). **This is
+  the only source Flux applies to the cluster.**
+- `values-staging.yaml` / `values-production.yaml` in `deploy/helm/`, used
+  *only* for direct `helm upgrade -f ...` invocations. **Flux never reads
+  these files**, so editing them has no effect on the live deploy and they
+  can silently drift from the HelmRelease.
 
 Key shape decisions:
 
-- **`replicas: 1`, `strategy: Recreate`.** SQLite is single-writer.
+- **`replicas: 1`, `strategy: Recreate`.** SQLite is single-writer. This
+  also keeps the in-process Astro response cache (`memoryCache()` in
+  `app/astro.config.mjs`, fed by `Astro.cache.set(cacheHint)` on the
+  content pages) coherent: it is per-process, so a second replica would
+  hold a divergent, independently-expiring cache. Scaling out would
+  require a shared cache provider, not just relaxing the SQLite writer
+  constraint.
 - **`nodeSelector: kotkan`.** `local-path` PV is sticky to one node; emdash
   is colocated with the legacy kotkanagrilli WP install.
 - **Pinned by digest, not tag.** The HelmRelease sets