feat: Unraid deploy, dealer-flow heatmap, confluence zones, 13F capture

Ship Node production images, Unraid compose, and Gitea CI/CD (test then
push registry images; cron script if no runner). Rebuild dealer flow as a
heatmap-first map with integrity gates and chart helpers. Add confluence
zone rules, session clock, capture evidence, and tighter 13F/queue/options
paths, plus the matching UI and tests.

deploy/unraid/act-runner-compose.yml

@@ -0,0 +1,27 @@
+# Gitea Actions runner for Unraid. One-time setup so CI/CD actually executes.
+# Current Gitea (unraid.local:3003) has Actions enabled but zero runners —
+# every workflow run is cancelled until this container is registered.
+#
+# 1. In Gitea: Site Administration → Actions → Runners → Create new runner
+#    Copy the registration token.
+# 2. Put the token in .env next to this file:
+#      GITEA_INSTANCE_URL=http://10.37.0.86:3003
+#      GITEA_RUNNER_REGISTRATION_TOKEN=...
+# 3. docker compose -f act-runner-compose.yml up -d
+# 4. Confirm the runner is Idle on the Gitea runners page.
+
+name: gitea-act-runner
+
+services:
+  runner:
+    image: gitea/act_runner:0.2.13
+    restart: unless-stopped
+    environment:
+      CONFIG_FILE: /config.yaml
+      GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:-http://10.37.0.86:3003}
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:?set registration token}
+      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-unraid-investor-flow}
+      GITEA_RUNNER_LABELS: ubuntu-latest:docker://gitea/runner-images:ubuntu-22.04
+    volumes:
+      - ${GITEA_RUNNER_DATA:-/mnt/cache/appdata/gitea-runner}:/data
+      - /var/run/docker.sock:/var/run/docker.sock