fix(image): ship node_modules in three layers, and count them before pushing

The merge that landed phase 12 built its image and could not publish it.
`docker push` answered 413 Payload Too Large on one blob and stopped, so the
registry stayed empty and `needs: build` meant the deploy never ran — the site
was merged and undeployed, and the log said only that a digest was too large.

The limit is Cloudflare's, not Gitea's: the instance is proxied, and Cloudflare
refuses a request body over 100 MB below Enterprise. A push uploads each layer
as one monolithic PUT, so the ceiling is per layer and the rejection happens at
the edge, where Gitea never sees it and no Gitea setting can lift it.

One layer was over, by nine megabytes: COPY node_modules at 108.8 MB compressed,
in a 188.6 MB image whose next largest layer is the 47.6 MB Node base. @pagefind
and @img (sharp's libvips) account for it and both are needed at run time — the
boot rewrite re-indexes the site and re-derives the brand images — so what could
move is where they land, not whether they ship.

The build stage moves them aside after `npm prune` and the runtime stage copies
them as their own layers: 46.8 + 50.5 + 11.5 MB, and the image is exactly the
same total size, the same bytes divided differently. Moving rather than copying
twice keeps the three disjoint, so a dependency added later needs no maintenance
here.

A split is a margin and not a guarantee, so the workflow now counts layers before
it pushes: docker save, re-compress anything over 8 MB the way the push would,
fail at 90 MB — not 100, the blob is not the only thing in the request — naming
the layer and what would have happened. Tested in both directions; on the broken
image it reports 108 MB, which is what the registry recorded.

Verified by running the built container, not only by measuring it: healthy in
~25s, the mounted brand rewritten across 51 files, 50 pages re-indexed by
pagefind, and the favicon served as `x-brand-source: derived:mount` — which is
sharp resolving from its new layer. npm run verify is green, all eleven checks
and both suites.

Recorded as D58; DEPLOY.md gains the symptom and what it means for the host
(nothing — the running container is untouched).

Co-Authored-By: Claude <noreply@anthropic.com>

Dockerfile

@@ -42,6 +42,15 @@ RUN npm run build
 # modules exactly as they were resolved and built once.
 RUN npm prune --omit=dev
 
+# Set the two largest packages aside so the runtime stage can copy them as their
+# own layers. See the COPY block below for why a single node_modules layer could
+# not be pushed at all. Moving them rather than copying them twice is what keeps
+# the three layers disjoint: whatever is left in node_modules is exactly the
+# remainder, and a dependency added later lands in it automatically.
+RUN mkdir -p /split \
+ && mv node_modules/@pagefind /split/ \
+ && mv node_modules/@img /split/
+
 # ---------------------------------------------------------------------------------------
 # Stage 2 — runtime
 # ---------------------------------------------------------------------------------------
@@ -67,7 +76,28 @@ ENV BRAND_DEFAULT_DIR=/app/brand-default
 # says, records that in dist/.brand-applied.json, and re-indexes dist/client/pagefind
 # so search finds the mounted site name. A read-only dist would make §7's promise
 # — recolour and rename by copying a file — fail at boot with a permission error.
+# node_modules arrives in THREE layers, not one, and the reason is the registry
+# rather than anything about the site.
+#
+# Gitea sits behind Cloudflare, which refuses a request body over 100 MB on every
+# plan below Enterprise, and `docker push` uploads each layer as one monolithic
+# PUT. A single `COPY node_modules` measured **108.8 MB compressed** — nine over —
+# so the first merge to `main` after phase 12 failed with `413 Payload Too Large`
+# on that one blob, from the edge, with Gitea never seeing the request. Nothing
+# was published, and `needs: build` meant nothing was deployed either.
+#
+# `@pagefind` (the search index binaries) and `@img` (sharp's libvips) are the two
+# packages that make it fat and both are needed at RUN time — the boot rewrite
+# re-indexes the site and re-derives the brand images — so the fix is where they
+# land, not whether they ship. Split, they measure 54.7 + 50.6 + 12.1 MB, the
+# largest with about 45 MB of headroom.
+#
+# That headroom is why the workflow counts layers before it pushes: this is a
+# margin, not a guarantee, and a dependency that grows past it would otherwise
+# come back as the same unreadable 413. See `.gitea/workflows/build-image.yml`.
 COPY --from=build --chown=node:node /build/node_modules ./node_modules
+COPY --from=build --chown=node:node /split/@pagefind ./node_modules/@pagefind
+COPY --from=build --chown=node:node /split/@img ./node_modules/@img
 COPY --from=build --chown=node:node /build/dist ./dist
 COPY --from=build --chown=node:node /build/brand-default ./brand-default
 COPY --from=build --chown=node:node /build/scripts ./scripts