CI: gate deploys on tests; upgrade to Node 24 LTS and nginx 1.30

[DeanCron]

Why

• Pushes to main deployed straight to production with no lint/test step.
• The Docker build stage used node:20-alpine (Node 20 reached EOL April 2026); runtime used nginx:1.27-alpine.

Changes

• CI gate (deploy.yml): new test job — npm ci, lint, vitest, server tests (npm run test:server), and npm run build (typecheck + bundle budget). Runs on PRs; build-and-deploy now needs: test and is skipped for PRs.
• Dockerfile: node:24-alpine build stage; nginx:1.30-alpine runtime (Alpine 3.24 ships Node 24 for the OG/dev-todos/broadband sidecars).
• better-sqlite3 11 → 12: v11 has no Node 24 (ABI 137) prebuilds; v12 does. API usage (prepare/pragma/get/all) unchanged.
• sharp → 0.35.5: fixes high-severity librsvg CVE (GHSA-wq5f-xc86-pv6w), relevant since the OG sidecar renders SVG.
• .nvmrc = 24, used by both workflows.
• allowScripts in package.json for native deps (npm's new install-scripts approval gate).
• npm audit fix for dev-only advisories (vitest, xmldom, humanfs).

Verification (local, Node 24.21)

• Clean npm ci ✅, lint ✅, 205/205 unit tests ✅, 3/3 server tests ✅, build + bundle budget ✅, better-sqlite3 + sharp load/render ✅.
• ⚠️ Docker image not built locally (no Docker available); first real image build happens on merge to main.

Known remaining

• 4 audit findings inside mapshaper (dev-only build tool); the only fix is a major downgrade, so left as-is.