chore: fix monorepo build pipeline and migrate shared to built package (#1056)

* chore: fix monorepo build pipeline and migrate shared to built package

- Root package.json: add workspace scripts (dev, build, test, test:cov, test:e2e)
  that delegate to actual scripts in shared/server/client workspaces
- shared: add tsup build step (CJS + ESM dual output, .d.ts); consumers now import
  from the built dist instead of raw TS source via path aliases
- server: replace tsc-alias with tsconfig-paths (tsc-alias mangled node_modules
  paths); fix MCP SDK path aliases to point to root node_modules (../node_modules)
- server/scripts/dev.mjs: delay node --watch until tsc -w signals first-pass done,
  eliminating the spurious restart on every dev startup
- client/vite.config.js + vitest.config.ts: remove @trek/shared path alias (no longer
  needed now that shared is a proper package)
- Consolidate package-lock.json at the workspace root; drop per-workspace lock files

* chore: fix test script to reflect root package.json

* chore: add missing lint and prettier script in root package.json

* fix(ci): build shared before tests; fix vitest MCP SDK alias paths

vitest.config.ts aliases pointed at ./node_modules/ (server-local) but
packages are hoisted to the root node_modules/ in the npm workspace —
changed to ../node_modules/.

CI jobs now install and build shared before running server/client tests
so that @trek/shared's dist/ exists when vitest resolves the package.

* fix(docker): update Dockerfile and CI for monorepo workspace structure

Dockerfile:
- Add shared-builder stage that produces @trek/shared dist before
  client and server stages need it
- Each build stage carries root package.json + package-lock.json so npm
  can resolve @trek/shared as a workspace dependency
- Production stage installs via workspace context (npm ci --workspace=server
  --omit=dev) so node_modules/@trek/shared symlinks to shared/dist correctly
- Copy server/tsconfig.json into the image so tsconfig-paths/register can
  find the MCP SDK path aliases at runtime
- CMD cds into /app/server before starting node so tsconfig-paths baseUrl
  resolves and ../node_modules points to /app/node_modules
- Remove mkdir for /app/server (now a real dir); keep symlinks for uploads/data

docker.yml version-bump:
- Replace manual per-workspace cd+npm-version calls with single:
  npm version --workspaces --include-workspace-root --no-git-tag-version
  (mirrors the version:* scripts in root package.json)
- git add now references root package-lock.json; adds shared/package.json

.dockerignore: add shared/dist
package.json: fix version:prerelease preid (alpha → pre)

* fix(tests): use in-memory SQLite per worker in test mode

vitest pool:forks spawns parallel worker processes that all called
initDb() on the same data/travel.db, causing SQLite "database is locked"
and "duplicate column name" races.

When NODE_ENV=test each fork now gets an isolated :memory: DB so migrations
run independently with no file contention.

* chore(ci): add ACT guards to skip DockerHub steps in local act runs

act sets ACT=true automatically. Guards added:
- docker login: if: ${{ !env.ACT }}
- build outputs: type=docker (local load) when ACT, push-by-digest when CI
- digest export/upload: if: ${{ !env.ACT }}
- merge job: if: ${{ !env.ACT }}
- release-helm job (docker.yml): if: ${{ !env.ACT }}
- version-bump git push (docker.yml): wrapped in [ -z "$ACT" ] shell guard

Run locally with:
  ./bin/act -j build -W .github/workflows/docker.yml \
    -P ubuntu-latest=catthehacker/ubuntu:act-latest

* fix(ci): move ACT guards to step level; add guards to security.yml

env context is invalid in job-level if conditions — moved all ACT
guards down to individual steps. Also guards docker login + scout
in security.yml so act can run the build-only part of that workflow.

* fix(ci): skip git fetch and tag logic in act (no remote access in local containers)

* Revert "fix(ci): skip git fetch and tag logic in act (no remote access in local containers)"

This reverts commit 67cf290cda.

* Revert "fix(ci): move ACT guards to step level; add guards to security.yml"

This reverts commit f92b95e054.

* Revert "chore(ci): add ACT guards to skip DockerHub steps in local act runs"

This reverts commit 797183de08.

* fix(docker): add musl optional deps so alpine builds find native rollup/sharp binaries

npm prunes libc-constrained optional deps to the host libc (glibc) when
generating the lockfile, leaving no musl entry for Alpine containers.
Declaring the x64/arm64 musl variants as explicit root optionalDependencies
forces them into the lockfile so npm ci on Alpine can install them.

Covers shared-builder (tsup/rollup) and client-builder (vite/rollup + sharp
icon generation) for both linux/amd64 and linux/arm64 CI targets.

* fix(docker): copy client dist into server/public so the server resolves static files correctly

The server runs from /app/server and serves static files relative to that
directory, so the client build output must land at /app/server/public, not /app/public.

server/vitest.config.ts

@@ -38,32 +38,25 @@ export default defineConfig({
   },
   resolve: {
     alias: {
-      // @trek/shared — Zod contract package (tests resolve it to TS source,
-      // mirroring the tsconfig `paths` the tsx runtime uses).
-      '@trek/shared': new URL('../shared/src/index.ts', import.meta.url).pathname,
+      // MCP SDK's exports map uses extension-less wildcard targets that neither
+      // Node nor Vite can resolve. Point directly at the CJS dist files.
+      // Paths are relative to the monorepo root (packages are hoisted there).
       '@modelcontextprotocol/sdk/server/mcp': new URL(
-          './node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js',
+          '../node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js',
           import.meta.url
       ).pathname,
       '@modelcontextprotocol/sdk/server/streamableHttp': new URL(
-          './node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.js',
+          '../node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.js',
           import.meta.url
       ).pathname,
       '@modelcontextprotocol/sdk/inMemory': new URL(
-          './node_modules/@modelcontextprotocol/sdk/dist/cjs/inMemory.js',
+          '../node_modules/@modelcontextprotocol/sdk/dist/cjs/inMemory.js',
           import.meta.url
       ).pathname,
       '@modelcontextprotocol/sdk/client/index': new URL(
-          './node_modules/@modelcontextprotocol/sdk/dist/cjs/client/index.js',
+          '../node_modules/@modelcontextprotocol/sdk/dist/cjs/client/index.js',
           import.meta.url
       ).pathname,
     },
-    // The server build emits @trek/shared next to its source (shared/src/*.js,
-    // needed by the prod dist via tsc-alias). Vite's default extension order
-    // prefers .js over .ts, so after a build the tests would load that compiled
-    // CJS instead of the source — and its `require('zod')` is unresolvable from
-    // the shared/ dir on CI (only server deps are installed there). Resolve .ts
-    // first so tests always run the source, whose zod import resolves via Vite.
-    extensions: ['.ts', '.mts', '.mjs', '.js', '.cts', '.cjs', '.tsx', '.jsx', '.json'],
   },
 });