Replatform Phase 7 — Hosting

[Th3FenrisWolf]

Hosts Kitchen Command Center on a Raspberry Pi 5 behind a Cloudflare Tunnel: replatform Phase 7 (plan; spec §13).

• The app trusts forwarded headers from the tunnel's address alone, sends HSTS, and runs in Umbraco's Production mode, with its logs on the data volume and the install off after the first boot. The Vite manifest now publishes.
• One Dockerfile builds the app and SSR images from one front-end build, and a small image carries the backup jobs.
• deploy/compose.yaml runs them read-only, with cloudflared as the only way in. deploy/smoke-test.sh checks the site, the trust boundary and a backup restored into fresh volumes.
• The Pi deploys by pull every five minutes (deploy/deploy.sh), and backs up nightly to R2. The steps are in docs/hosting/runbook.md.
• A new images job builds and smoke-tests the images on an arm64 runner, and pushes them to private GHCR packages on main. Dependabot keeps NuGet, npm, the base images and the actions current.
• Where review found holes in the plan's text, the code departs from it (the plan's "Findings from Phase 7" lists each with its reason): the SSR install has its own Yarn cache, because two parallel cold installs corrupt a shared one; the smoke test's server-rendering check no longer passes on the empty client-side fallback, and its cleanup also runs on Ctrl-C and kill; kcc-backup refuses a database that is missing, empty, corrupt or without Umbraco's schema (backups, restores and rollbacks alike), and fails the night (deleting the upload) when tar fails; deploy.sh records the last deployed commit in refs/kcc/deployed, fails loudly while a service is stopped or unhealthy, and snapshots only while the app is running and not unhealthy; the images job moves the main tags only after every commit tag is up, never cancels a run on main, and never moves main back, and build-and-test shellchecks the deploy scripts. The runbook and the spec (§6.5, §13.2 to §13.4, §13.7, §15) describe what was built.

Test plan: the combined suite is green (unit 232, integration 260, E2E 41, Vitest 796: 769 web plus its 2 expected failures, 17 admin and 8 contributions); the images build and the smoke test passes locally. CI's images job runs once this pull request targets main.

Still to do, by the owner:

• Task 9: Cloudflare, the bucket and GitHub.
• Task 10: the Pi and the first boot.
• Task 11: the gate, with the site reachable behind Access and a restore rehearsed from the bucket.
• Task 12: close the phase.