Server: web client under /app/ (D-132), analytics E-34 trends and E-35 forecast (D-133)

Part A (D-132): KVITT_WEB_DIR (default /app) served under /app/ by a small handler: /app redirects to
/app/, app routes fall back to index.html, a missing assets/* file is 404, assets cached immutable,
index.html no-store, the app's own CSP plus nosniff, DENY and no-referrer. Unsafe paths never reach the
file system. /app paths count against the unauthenticated per-IP limit. Without the directory every /app
path stays 404 not_found. server/Dockerfile gains a Node 24 LTS stage (pinned by digest) building web/,
passed through the Rust stage so npm and rustc never run at once on the Pi 3; the build context is the
repository root with an allowlist .dockerignore (server/.dockerignore removed); workflow, build-images.sh
and infra/dev/build.sh follow.

Part B (D-133): GET /analytics/trends (E-34) and GET /analytics/forecast (E-35), authenticated, read-only,
SQL month buckets; rules (half-up average, trailing 3-month moving average, percent against the rounded
average, template occurrence per month) in kvitt-domain::analytics. OpenAPI, examples, contracts-check
and tests updated (35 operations).

Cargo.lock: rustls-webpki 0.103.16 and webpki-root-certs 1.0.10 (RUSTSEC-2026-0382, -0383) so that
cargo audit passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

.gitea/workflows/build-images.yaml

@@ -11,8 +11,9 @@
 # the credentials actions/checkout stored (the job's own token), not this secret, so it needs no write:repository.
 #
 # RISK: the runner is a Raspberry Pi 3 with 1 GB RAM and the server image compiles about 232 Rust crates
-# (aws-lc-sys's C code included). The build passes CARGO_BUILD_JOBS=1 to keep memory down; server/Dockerfile
-# honours it (`ARG CARGO_BUILD_JOBS`, SPEC §10.3). The Dockerfile keeps the cargo registry and the target directory
+# (aws-lc-sys's C code included), after an npm ci and Vite build of the web client (D-132; not yet measured on the
+# Pi). The build passes CARGO_BUILD_JOBS=1 to keep memory down; server/Dockerfile honours it (`ARG CARGO_BUILD_JOBS`,
+# SPEC §10.3). The Dockerfile keeps the cargo registry and the target directory
 # in BuildKit cache mounts, which persist in the reused builder `local-http-builder`, so later builds are
 # incremental. First-build duration on the Pi: unknown.
 # The builder's buildkitd.toml is read only when the builder is created; after changing it, remove the builder on
@@ -34,6 +35,8 @@ on:
   push:
     paths:
       - "server/**"
+      - "web/**"
+      - "contracts/**"
       - "infra/backup/**"
       - ".gitea/workflows/**"
   workflow_dispatch: {}
@@ -65,13 +68,16 @@ jobs:
         with:
           # Tells the action to use the local 'git' binary installed above
           set-safe-directory: 'true'
-          # Only the two build contexts: server/Dockerfile copies its own context (server/, Cargo workspace,
-          # migrations and the import's category table included) and infra/backup/Dockerfile copies backup.sh and
-          # healthcheck.sh. Cone mode also checks out the files at the root and directly in infra/. A sparse
-          # checkout makes the action fetch with --filter=blob:none, so only the blobs of these paths are downloaded
-          # (not the Android screenshot goldens).
+          # Only what the two builds read: server/Dockerfile builds from the repository root (D-132) and copies
+          # server/ (Cargo workspace, migrations, the import's category table), web/ (the web client, built by its
+          # Node stage) and contracts/; the root .dockerignore keeps everything else out. infra/backup/Dockerfile
+          # copies backup.sh and healthcheck.sh. Cone mode also checks out the files at the root (.dockerignore
+          # included) and directly in infra/. A sparse checkout makes the action fetch with --filter=blob:none, so
+          # only the blobs of these paths are downloaded (not the Android screenshot goldens).
           sparse-checkout: |
             server
+            web
+            contracts
             infra/backup
           sparse-checkout-cone-mode: true
           # Full commit and tag history (trees and commits only, no blobs, because of the filter above): "Determine
@@ -105,7 +111,8 @@ jobs:
             --push
       - name: Build server image
         run: |
-          # Context server/: server/Dockerfile copies the Cargo workspace from its own directory.
+          # Context: the repository root (D-132). server/Dockerfile builds the web client first (Node stage), then
+          # the Rust binaries, one after the other, so npm and rustc never share the Pi's 1 GB.
           docker buildx build \
             --platform linux/arm64 \
             --provenance=false \
@@ -114,7 +121,7 @@ jobs:
             -t "$REGISTRY/kvitt-server:$VERSION" \
             -t "$REGISTRY/kvitt-server:latest" \
             --metadata-file /tmp/kvitt-server.metadata.json \
-            ./server \
+            . \
             --push
       - name: Print image digests
         # The digests the Kvitt Pi pulls (cd ~/kvitt && docker compose images, or docker image inspect) must match.