feat: Unraid deploy, dealer-flow heatmap, confluence zones, 13F capture

Ship Node production images, Unraid compose, and Gitea CI/CD (test then
push registry images; cron script if no runner). Rebuild dealer flow as a
heatmap-first map with integrity gates and chart helpers. Add confluence
zone rules, session clock, capture evidence, and tighter 13F/queue/options
paths, plus the matching UI and tests.

app/server/Dockerfile

@@ -1,17 +1,27 @@
-# Investor Flow — Backend Dockerfile (Bun)
-FROM oven/bun:1-alpine AS backend
-
+# Investor Flow backend — Node 22 + native type-stripping + node:sqlite.
+# Build context: app/server
+FROM node:22-bookworm-slim AS deps
 WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
 
-# Install dependencies
-COPY server/package.json server/bun.lock* ./
-RUN bun install --frozen-lockfile || bun install
-
-# Copy server source
-COPY server/ ./
-
-# Expose backend port
+FROM node:22-bookworm-slim AS runner
+WORKDIR /app
+ENV NODE_ENV=production \
+    HOST=0.0.0.0 \
+    PORT=3001 \
+    IFLOW_DB_PATH=/app/data/investor-flow.db
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates tini \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /app/data
+COPY --from=deps /app/node_modules ./node_modules
+COPY package.json ./
+COPY tsconfig.json ./
+COPY src ./src
 EXPOSE 3001
-
-# Start the server
-CMD ["bun", "run", "dev"]
+VOLUME ["/app/data"]
+HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:3001/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+ENTRYPOINT ["tini", "--"]
+CMD ["node", "--experimental-strip-types", "src/index.ts"]