sync: update from private repo (11e2d76)

Dockerfile

@@ -33,17 +33,32 @@ COPY scripts ./scripts
 RUN npm run build:server
 RUN npm run build:ui
 
-FROM node:22-alpine AS runtime
+# Runtime is Debian (NOT Alpine): the noVNC headed-browser stack needs glibc.
+# Playwright's bundled Chromium does not run on Alpine/musl, and Xvfb/x11vnc/
+# websockify + Chromium are well-supported on Debian. The builder stage stays
+# Alpine because it only emits portable artifacts (dist/, ui/dist, vendor/).
+FROM node:22-bookworm-slim AS runtime
 
-RUN apk add --no-cache \
+# System deps:
+#  - git/ca-certificates/tzdata/bash: app + git ops + the bash sandbox shell
+#  - bubblewrap/python3/python3-pip: sandboxed bash + pre-baked python tools
+#  - xvfb/x11vnc/websockify: the noVNC display stack (display_mode: novnc) that
+#    powers the Browser tab live view, InteractiveBrowse, and the CAPTCHA pool
+#  - fonts-*: legible text (incl. CJK) in the headed browser / screenshots
+RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     ca-certificates \
     tzdata \
     bash \
     bubblewrap \
     python3 \
-    py3-pip \
-    && apk add --no-cache --virtual .native-build-deps build-base
+    python3-pip \
+    xvfb \
+    x11vnc \
+    websockify \
+    fonts-liberation \
+    fonts-noto-cjk \
+    && rm -rf /var/lib/apt/lists/*
 
 # Pre-bake python packages into the system site-packages (read-only bind-mounted
 # into every bash sandbox). Runtime `pip install` is intentionally unsupported.
@@ -53,10 +68,24 @@ RUN pip3 install --no-cache-dir --break-system-packages -r /tmp/python-requireme
 
 WORKDIR /app
 
+# Shared, world-readable Playwright browser cache so the non-root `node` user can
+# launch Chromium (npm ci's playwright postinstall downloads it here).
+ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
+
 COPY package.json package-lock.json* ./
-RUN npm ci --omit=dev \
+# build-essential compiles better-sqlite3's native addon (removed afterward to
+# stay lean). `npm ci` also runs Playwright's postinstall → downloads Chromium
+# into PLAYWRIGHT_BROWSERS_PATH. `playwright install-deps chromium` then adds the
+# Chromium shared-library apt deps. chmod makes the browser readable by `node`.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential \
+    && npm ci --omit=dev \
+    && npx playwright install-deps chromium \
+    && chmod -R go+rX /ms-playwright \
     && npm cache clean --force \
-    && apk del .native-build-deps
+    && apt-get purge -y build-essential \
+    && apt-get autoremove -y \
+    && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/ui/dist ./ui/dist