#14: Gitea CI, registry composes, Node 22 image and changelog

- Gitea Actions: Trivy, Vitest in a Dockerfile test stage, arm64 image build, image
  scan and smoke test; releases reuse the image by content hash.
- docker-compose.<edition>.registry.yaml run the stack from the published image.
- Dockerfile: Node 22, a test stage, and no npm in the runtime image.
- README, CLAUDE.md and CHANGELOG describe the CI, the image and the release flow.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Dockerfile

@@ -4,7 +4,9 @@
 # Why not Alpine? `leveldb-zlib` is a native addon that compiles from source via
 # cmake-js. On Alpine/musl (esp. ARM64) that build repeatedly failed at the CMake
 # configure step; Debian glibc is the reliable path for this toolchain.
-FROM node:20-bookworm-slim AS builder
+
+# ── deps: every dependency (dev included) with the native addon compiled ──
+FROM node:22-bookworm-slim AS deps
 WORKDIR /app
 COPY package*.json ./
 # scripts/ must exist before npm ci: the postinstall hook runs the (no-op here)
@@ -13,24 +15,37 @@ COPY package*.json ./
 COPY scripts ./scripts
 RUN apt-get update \
  && apt-get install -y --no-install-recommends python3 make g++ cmake zlib1g-dev ca-certificates \
- && npm ci --omit=dev
+ && npm ci
+
+# ── test: `docker build --target test .` runs the Vitest suite (used by CI) ──
+FROM deps AS test
+COPY src ./src
+COPY test ./test
+COPY vitest.config.js ./
+RUN npm test
+
+# ── builder: production dependencies only ──
+FROM deps AS builder
+RUN npm prune --omit=dev
 
 # Item icons are generated at build time (not committed, not downloaded at
 # runtime): install the versioned minecraft-assets package and extract the flat
 # item PNGs. Bump ASSETS_VERSION (or rebuild) to pick up new game items.
-FROM node:20-bookworm-slim AS assets
+FROM node:22-bookworm-slim AS assets
 ARG ASSETS_VERSION=latest
 WORKDIR /app
 COPY scripts/extract-mc-assets.mjs scripts/
 RUN npm install --no-save --ignore-scripts minecraft-assets@${ASSETS_VERSION} \
  && node scripts/extract-mc-assets.mjs --required
 
-FROM node:20-bookworm-slim
+FROM node:22-bookworm-slim
 WORKDIR /app
-# Patch fixable OS CVEs in the base image at build time (trivy image scan).
+# Patch fixable OS CVEs in the base image at build time (trivy image scan). The
+# runtime only needs node: the npm bundled in the base image carries its own
+# dependencies, which Trivy reports and nothing here uses.
 RUN apt-get update \
  && apt-get upgrade -y \
- && rm -rf /var/lib/apt/lists/*
+ && rm -rf /var/lib/apt/lists/* /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 # The compiled node-leveldb.node links libz (zlib1g) and libstdc++6, both already
 # present in the slim base image — so no extra runtime packages are needed.
 COPY --from=builder /app/node_modules ./node_modules