harden(deploy): apply safe fixes from review report-only items

- #3 Liveness probe targets full SSR DB-querying / route, coupling pod liveness to SQLite
- #4 Chart values-staging/production.yaml are dead config under Flux; drift trap
- #6 tsconfig includes gitignored emdash-env.d.ts that only the dev server generates
- #7 Dockerfile package-lock glob + npm install fallback can silently build an unlocked image
- #8 Dockerfile creates runtime user without pinning its GID
- #9 entrypoint.sh gates `emdash init` on data.db absence, skipping migrations on PVC reuse
- #10 pullPolicy: Always vs digest pinning
- #11 Dockerfile state symlinks contradict the STATE_DIR contract; Dockerfile does not set ENV STATE_DIR
- #12 astro is a production dependency, so npm prune --omit=dev keeps build-only tooling
- #14 Two ImageUpdateAutomations write back to the same anton-helm-workloads main branch
- #16 memoryCache provider is per-process; correctness depends implicitly on replicas:1
- #17 Root catch-all [slug].astro couples nav links to pages-collection rows + DB hit per unmatched path
- #18 Detail pages render a 200-style body under a 404 status and have no try/catch around getEmDash* calls
- #19 vite allowedHosts hardcodes ddev hostnames (dev-only; no prod impact)

Dockerfile

@@ -5,16 +5,23 @@ WORKDIR /app
 RUN apt-get update \
  && apt-get install -y --no-install-recommends python3 make g++ ca-certificates \
  && rm -rf /var/lib/apt/lists/*
-COPY app/package.json app/package-lock.json* ./
-# package-lock.json may not exist on the first commit — fall back to `npm install`
-# so the image still builds; once a lockfile is committed, npm ci kicks in.
-RUN if [ -f package-lock.json ]; then npm ci --include=dev; else npm install --include=dev; fi
+COPY app/package.json app/package-lock.json ./
+# Lockfile (lockfileVersion 3) is committed; npm ci is reproducible and
+# fails if it drifts from package.json. No npm install fallback.
+RUN npm ci --include=dev
 
 FROM deps AS build
 WORKDIR /app
 COPY app/ ./
 RUN rm -f data.db data.db-shm data.db-wal && rm -rf uploads
 RUN npm run build
+# `astro` is a runtime dependency (required by the @astrojs/node standalone
+# SSR server), so this prune only drops the two devDependencies
+# (@astrojs/check, @types/node). Astro's transitive build tooling
+# (vite, esbuild, @astrojs/compiler, rollup plugins) stays in node_modules
+# because Astro itself declares them as runtime deps. Slimming those out
+# would require verifying the dist/server bundle never imports `astro/*` at
+# boot; not attempted here. Image-size tradeoff is accepted for now.
 RUN npm prune --omit=dev
 
 FROM node:22-bookworm-slim AS runtime
@@ -25,7 +32,8 @@ ENV NODE_ENV=production \
 RUN apt-get update \
  && apt-get install -y --no-install-recommends ca-certificates tini \
  && rm -rf /var/lib/apt/lists/* \
- && useradd --system --uid 1001 --home /app emdash \
+ && groupadd --system --gid 1001 emdash \
+ && useradd --system --uid 1001 --gid 1001 --home /app emdash \
  && mkdir -p /app/state/uploads \
  && chown -R emdash:emdash /app
 
@@ -35,8 +43,14 @@ COPY --from=build --chown=emdash:emdash /app/dist ./dist
 COPY --from=build --chown=emdash:emdash /app/seed ./seed
 
 # Persistent state lives in /app/state (single PVC in k3s).
-# data.db and uploads/ are symlinked from the working directory so the
-# default emdash paths (./data.db, ./uploads) resolve into the volume.
+# STATE_DIR is intentionally NOT set here: the Helm chart injects
+# STATE_DIR=/app/state (deploy/helm values.yaml), so the running app writes
+# directly to /app/state/data.db and /app/state/uploads and these symlinks
+# are never traversed. Leaving it unset keeps the image deploy-agnostic so a
+# bare `docker run` / DDEV smoke test falls back to the WORKDIR (./data.db).
+# The symlinks below only backstop that STATE_DIR-unset fallback
+# (astro.config.mjs: `process.env.STATE_DIR ?? "."`), redirecting the default
+# emdash paths into the volume — they do not contradict the STATE_DIR contract.
 RUN ln -s /app/state/data.db /app/data.db \
  && ln -s /app/state/uploads /app/uploads