feat: Unraid deploy, dealer-flow heatmap, confluence zones, 13F capture

Ship Node production images, Unraid compose, and Gitea CI/CD (test then
push registry images; cron script if no runner). Rebuild dealer flow as a
heatmap-first map with integrity gates and chart helpers. Add confluence
zone rules, session clock, capture evidence, and tighter 13F/queue/options
paths, plus the matching UI and tests.

.github/workflows/cd.yml

@@ -0,0 +1,54 @@
+# Manual image rebuild. The automatic path is the `images` job in ci.yml
+# (runs after tests on push to main). Keep this for "rebuild without a new commit".
+
+name: CD
+
+on:
+  workflow_dispatch:
+
+jobs:
+  images:
+    name: Build and push
+    runs-on: ubuntu-latest
+    env:
+      REGISTRY: ${{ vars.REGISTRY || '10.37.0.86:3003' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."10.37.0.86:3003"]
+              http = true
+              insecure = true
+            [registry."unraid.local:3003"]
+              http = true
+              insecure = true
+
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN || github.token }}
+
+      - name: Backend image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./app/server
+          file: ./app/server/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/transnet/investor-flow-backend:${{ github.sha }}
+            ${{ env.REGISTRY }}/transnet/investor-flow-backend:latest
+
+      - name: Frontend image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./app
+          file: ./app/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/transnet/investor-flow-frontend:${{ github.sha }}
+            ${{ env.REGISTRY }}/transnet/investor-flow-frontend:latest

.github/workflows/ci.yml

@@ -1,6 +1,11 @@
-# Investor Flow — CI Pipeline
-# Runs on every PR and push to main. Lint, type-check, and test both
-# frontend and backend. All checks must pass before merge.
+# Gitea Actions (GitHub-compatible). Tests on every PR / push.
+# On push to main, also builds and pushes images to the Gitea registry.
+#
+# Requires a registered act_runner labeled ubuntu-latest. Without a runner
+# Gitea marks the run cancelled. See deploy/unraid/act-runner-compose.yml.
+#
+# Repo secret REGISTRY_TOKEN: Gitea token with write:package + write:repository.
+# Optional var REGISTRY: default 10.37.0.86:3003 (HTTP; mark insecure in Docker).
 
 name: CI
 
@@ -9,10 +14,11 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 jobs:
   test:
-    name: Test & Type-Check
+    name: Test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -21,17 +27,83 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 22
+          cache: npm
+          cache-dependency-path: |
+            app/package-lock.json
+            app/server/package-lock.json
 
-      - name: Install dependencies
+      - name: Install frontend
         working-directory: app
-        run: npm install
+        run: npm ci
 
-      - name: Type-check (tsc --noEmit)
-        working-directory: app
-        run: npx tsc --noEmit || true  # non-blocking for now
+      - name: Install backend
+        working-directory: app/server
+        run: npm ci
 
-      - name: Run tests
+      - name: Frontend tests
         working-directory: app
-        run: node --test --experimental-strip-types "src/**/*.test.ts" "server/src/**/*.test.ts"
+        run: node --test --experimental-strip-types "src/**/*.test.ts"
         env:
           NODE_ENV: development
+
+      - name: Backend tests
+        working-directory: app/server
+        run: npm test
+        env:
+          NODE_ENV: development
+
+      - name: Backend typecheck
+        working-directory: app/server
+        run: npm run typecheck
+
+  images:
+    name: Build and push
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    env:
+      REGISTRY: ${{ vars.REGISTRY || '10.37.0.86:3003' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."10.37.0.86:3003"]
+              http = true
+              insecure = true
+            [registry."unraid.local:3003"]
+              http = true
+              insecure = true
+
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN || github.token }}
+
+      - name: Backend image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./app/server
+          file: ./app/server/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/transnet/investor-flow-backend:${{ github.sha }}
+            ${{ env.REGISTRY }}/transnet/investor-flow-backend:latest
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/transnet/investor-flow-backend:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/transnet/investor-flow-backend:buildcache,mode=max
+
+      - name: Frontend image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./app
+          file: ./app/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/transnet/investor-flow-frontend:${{ github.sha }}
+            ${{ env.REGISTRY }}/transnet/investor-flow-frontend:latest
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/transnet/investor-flow-frontend:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/transnet/investor-flow-frontend:buildcache,mode=max