Pi image arm64 check: C toolchain and CA roots confirmed, live OAuth/FCM probe; spike report

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/Dockerfile

@@ -6,6 +6,8 @@
 # ---- stage 1: build --------------------------------------------------------------------------------------------
 FROM docker.io/library/rust:1.99.1-bookworm AS build
 ARG TARGETARCH
+# The full bookworm image carries gcc 12 and make, which aws-lc-sys (rustls via reqwest, jsonwebtoken) needs to
+# compile its C code; no cmake binary is needed (checked 2026-10-18, docs/spikes/pi-image-arm64.md).
 # Use the image's toolchain as is; rust-toolchain.toml names the same version but would also pull clippy/rustfmt.
 ENV RUSTUP_TOOLCHAIN=1.99.1 \
     CARGO_TERM_COLOR=never
@@ -25,7 +27,8 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     && cp "target/$triple/release/kvitt-server" "target/$triple/release/kvitt-import" /out/
 
 # ---- stage 2: runtime ------------------------------------------------------------------------------------------
-# glibc + libgcc, no shell, no package manager. Pinned by digest (multi-arch index of :nonroot).
+# glibc + libgcc, no shell, no package manager. Pinned by digest (multi-arch index of :nonroot). It carries the
+# Debian CA bundle at /etc/ssl/certs/ca-certificates.crt, which rustls-platform-verifier reads to reach Google.
 FROM gcr.io/distroless/cc-debian12:nonroot@sha256:9dac0a79194e45a7da0158a9c6da57b217585af0786db3845d1f0ec1a0dd182f
 COPY --from=build /out/kvitt-server /out/kvitt-import /usr/local/bin/
 # Runs as uid/gid 10001 with a read-only root filesystem; /data is the only writable volume and /secrets is