Server: web client under /app/ (D-132), analytics E-34 trends and E-35 forecast (D-133)

Part A (D-132): KVITT_WEB_DIR (default /app) served under /app/ by a small handler: /app redirects to
/app/, app routes fall back to index.html, a missing assets/* file is 404, assets cached immutable,
index.html no-store, the app's own CSP plus nosniff, DENY and no-referrer. Unsafe paths never reach the
file system. /app paths count against the unauthenticated per-IP limit. Without the directory every /app
path stays 404 not_found. server/Dockerfile gains a Node 24 LTS stage (pinned by digest) building web/,
passed through the Rust stage so npm and rustc never run at once on the Pi 3; the build context is the
repository root with an allowlist .dockerignore (server/.dockerignore removed); workflow, build-images.sh
and infra/dev/build.sh follow.

Part B (D-133): GET /analytics/trends (E-34) and GET /analytics/forecast (E-35), authenticated, read-only,
SQL month buckets; rules (half-up average, trailing 3-month moving average, percent against the rounded
average, template occurrence per month) in kvitt-domain::analytics. OpenAPI, examples, contracts-check
and tests updated (35 operations).

Cargo.lock: rustls-webpki 0.103.16 and webpki-root-certs 1.0.10 (RUSTSEC-2026-0382, -0383) so that
cargo audit passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/build-images.sh

@@ -3,7 +3,8 @@
 # The Mac fallback for the Gitea Actions workflow .gitea/workflows/build-images.yaml (which is the normal path).
 # Usage: infra/build-images.sh [tag]      tag defaults to the short git SHA of HEAD; `latest` is always tagged too.
 #
-# Images (D-104, D-120): ${KVITT_REGISTRY}/kvitt-server (context server/) and kvitt-backup (infra/backup).
+# Images (D-104, D-120): ${KVITT_REGISTRY}/kvitt-server (context: the repository root, D-132; server/Dockerfile
+# builds the web client too) and kvitt-backup (infra/backup).
 # KVITT_REGISTRY and the optional credentials come from infra/secrets/registry.env (git-ignored):
 #   KVITT_REGISTRY=gitea.lan/jacobh2
 #   KVITT_REGISTRY_USER=<gitea user>          optional
@@ -39,7 +40,7 @@ registry_host="${registry%%/*}"
 
 # name|context|dockerfile
 images=(
-  "kvitt-server|server|server/Dockerfile"
+  "kvitt-server|.|server/Dockerfile"
   "kvitt-backup|infra/backup|infra/backup/Dockerfile"
 )
 

infra/dev/build.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Builds the development images on this Mac (native linux/arm64, nothing pushed):
-#   kvitt-server:dev  from server/Dockerfile
+#   kvitt-server:dev  from server/Dockerfile (context: the repository root, D-132: it builds web/ too)
 #   kvitt-backup:dev  from infra/backup/Dockerfile
 # Usage: infra/dev/build.sh [server|backup|all]   (default: all)
 # Refuses to run while a Gradle build holds the gradle-serial lock (CLAUDE.md: never build images during a Gradle build).
@@ -20,7 +20,7 @@ backup_image="$(env_value KVITT_BACKUP_IMAGE kvitt-backup:dev)"
 
 build_server() {
   local dockerfile="$repo_root/server/Dockerfile"
-  local context="${KVITT_SERVER_BUILD_CONTEXT:-$repo_root/server}"
+  local context="${KVITT_SERVER_BUILD_CONTEXT:-$repo_root}"
   echo "Building $server_image from server/Dockerfile"
   docker build --platform linux/arm64 -f "$dockerfile" -t "$server_image" "$context"
 }