ci: engines >=20 + .nvmrc; hard audit gate; boot check; bundle budget; eslint ratchet

- engines.node >=20.0.0 and .nvmrc mirroring .node-version (#54)
- npm audit --audit-level=high is a hard gate (tree is at 0) (#91)
- scripts/boot-check.mjs serves dist/ with vite preview and asserts /,
  config.json, the entry chunk and the Element Call bundle all load (#92)
- scripts/check-bundle-size.mjs enforces gzip budgets from
  scripts/bundle-budget.json (seeded +10%); fails PRs, warns on push (#96)
- check:eslint runs with --max-warnings 68 so the count can only go down;
  7 unused eslint-disable directives removed to get there (#97)

Fixes #54
Fixes #91
Fixes #92
Fixes #96
Fixes #97

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

.gitea/workflows/ci.yml

@@ -64,8 +64,12 @@ jobs:
       # gate real regressions. NOTE: the lotus-build.sh upstream-merge path can
       # deploy without CI; a later normal push surfaces any introduced issue here
       # — fix forward (or briefly re-soften a gate) rather than deploy broken.
-      # eslint gates on errors only (existing no-explicit-any warnings stay
-      # informational — check:eslint has no --max-warnings).
+      # eslint gates on errors, plus a warning ratchet (Gitea #97): `check:eslint`
+      # runs with `--max-warnings 74`, the exact warning count on this tree at
+      # the time the ratchet was added. New warnings push the count over that
+      # ceiling and fail the build; fixing an existing warning is free to do
+      # and should lower the ceiling in the same PR so the count can only go
+      # down over time, never back up.
       - name: Prettier
         run: npm run check:prettier
 
@@ -87,25 +91,25 @@ jobs:
           NODE_OPTIONS: '--max_old_space_size=4096'
           VITE_APP_VERSION: ${{ github.sha }}
 
-      # ── Security (informational — findings shouldn't block a deploy) ─────
+      # ── Boot check — actually loads the built dist/, not just builds it ──
+      - name: Boot check
+        run: node scripts/boot-check.mjs
+
+      # ── Security — hard gate. #24 cleared the outstanding advisories (0
+      # vulnerabilities on this tree, verified with `npm audit --omit=dev`), so
+      # there is nothing left this should be soft against. Hard on both
+      # `push` and `pull_request`: a new high/critical advisory should block
+      # the deploy just as much as it should block the PR.
       - name: Audit (high/critical)
         run: npm audit --audit-level=high --omit=dev
-        continue-on-error: true
 
-      # ── Bundle size report (informational — never blocks a deploy) ───────
-      - name: Report bundle sizes
-        continue-on-error: true
-        run: |
-          echo "### Bundle sizes" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| File | Size | Gzip |" >> $GITHUB_STEP_SUMMARY
-          echo "|------|------|------|" >> $GITHUB_STEP_SUMMARY
-          find dist/assets -name "*.js" -not -name "*.map" | sort | while read f; do
-            name=$(basename "$f")
-            size=$(du -sh "$f" | cut -f1)
-            gzip_size=$(gzip -c "$f" | wc -c | awk '{printf "%.1f kB", $1/1024}')
-            echo "| $name | $size | $gzip_size |" >> $GITHUB_STEP_SUMMARY
-          done
+      # ── Bundle size budget — hard gate on pull_request, warning on push (a
+      # push has already merged; failing it can only delay deploying an
+      # otherwise-good commit, not prevent the regression, so pull_request is
+      # where this should be caught). Budgets live in scripts/bundle-budget.json.
+      - name: Check bundle size budget
+        continue-on-error: ${{ github.event_name == 'push' }}
+        run: node scripts/check-bundle-size.mjs ${{ github.event_name }}
 
   # ── Desktop build trigger ──────────────────────────────────────────────
   # Gated on `build` succeeding so a broken push (e.g. failing `npm ci` or