Slim the image, publish on version tags, drop deployment specifics

The first publish failed partway through the push with 413 Payload Too Large:
one layer was bigger than the proxy in front of the registry would accept.

Three changes, only one of which is that fix.

Keep deployment out of a public repo. The registry, image name and credentials
now come from repository variables and secrets rather than being written down
here, and the docs describe how to run the thing rather than where one
particular instance runs. PUBLIC_ORIGIN defaults to localhost. The 413 is a
proxy limit, so the fix is pointing REGISTRY at a host the runner reaches
directly; the workflow explains itself if that host is plain HTTP and the
builder's daemon has not been told to allow it.

Publish on version tags. A tag like 1.2.3 publishes :1.2.3, :1.2, :1 and
:latest; a prerelease publishes only its exact version and leaves :latest
alone. Pushes to main publish :main and :sha-<short> and no longer move
:latest, so what is deployed moves when a release says so.

Shrink the image from over 1.2GB to 353MB. The Playwright base image carries
Firefox and WebKit, which this never launches. Installing just the browser it
does launch onto a slim Node base drops two thirds of the weight, which is
worth having on a Raspberry Pi even though it does not get any single layer
under a proxy limit.

That last change surfaced something worth naming: a headless launch resolves to
Playwright's headless shell, not the full browser, so that is what every test
so far has actually been running. The image now installs exactly that binary
and pool.ts names the channel, so the two cannot drift apart.

Verified in the container: Bluesky, Instagram, X and Threads all resolve
identically on the slim image.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01BGkRmLfiWuJHx6tQ12EELY

CLAUDE.md

@@ -5,9 +5,14 @@ links to X, Threads, Instagram, TikTok and Bluesky into `/<prefix>/<original pat
 this resolves the post by driving a real headless Chromium and renders the media, the
 text, a platform badge and a copy-the-original button.
 
-Single user, no auth, tailnet only, running on Kallone (lab3). `README.md` has the
+Built for one person on a private network, with no authentication. `README.md` has the
 rewrite rules and the user-facing description. This file is the working context.
 
+This repository is public and deliberately says nothing about where any particular
+instance runs. Keep deployment specifics — hostnames, clusters, registries, manifests —
+out of it; they belong in whatever private repo does the deploying. Configuration is
+read from the environment, and CI reads the registry from repository variables.
+
 ## The main job: "this link didn't work"
 
 That is the recurring task. Work it in this order and do not skip step 1.
@@ -132,12 +137,23 @@ npm run dev                  # http://localhost:8080
 container build --tag antisocial:dev .   # Apple container, not Docker
 ```
 
-## Deployment
+## Publishing
 
-CI (`.gitea/workflows/publish.yml`) builds on main and pushes
-`git.unsupervised.ca/unsupervised/antisocial:latest` and `:sha-<short>`. Manifests live
-in the **`infra` repo** at `k8s/kallone/antisocial.unsupervised.studio/`; Flux syncs
-`k8s/kallone` every 10 minutes. The DNS CNAME is in `infra/cloudflare/unsupervised.studio.tf`.
+`.gitea/workflows/publish.yml` builds the image and pushes it. A push to main publishes
+`:main` and `:sha-<short>`; a version tag like `1.2.3` publishes `:1.2.3`, `:1.2`, `:1`
+and `:latest`. A prerelease tag (`1.2.3-rc1`) publishes only its exact version and does
+not move `latest`.
 
-Chromium needs the memory-backed `/dev/shm` volume in the deployment — it crashes against
-the 64Mi default. Measured 623Mi resident.
+The registry comes from the `REGISTRY` repository variable, the image name from
+`IMAGE_NAME` or the repository name, and credentials from `REGISTRY_USER` and the
+`REGISTRY_TOKEN` secret. Nothing about any particular deployment is committed here.
+
+Two things any deployment has to get right, both learned the hard way:
+
+- **Chromium needs more than the default 64Mi `/dev/shm`** or it crashes. Mount a
+  memory-backed volume of a few hundred Mi at `/dev/shm`.
+- **The registry must be reachable without a proxy that caps request bodies.** The image
+  has a layer well over 100MB; a proxy with a smaller limit fails the push partway
+  through with `413 Payload Too Large`.
+
+Measured around 620Mi resident with the browser up.