Package verified Dune checkpoints for TrueNAS and HTTPS proxying

Serve built Workers directly through pinned Miniflare with persistent D1-compatible storage and startup migrations. Build and verify Docker images in CI; publish main checkpoints to GHCR for manual TrueNAS updates on port 33046. Preserve explicit public-origin checks and LAN-compatible cryptographic operation IDs.

Validation: 5,153 offline tests, typecheck, lint and build; 49 HTTP integration cases; HTTPS-origin create/join/chat/seat protection, foreign-origin rejection, exact saved-seat restart and browser asset serving. Independent persistence/proxy review completed. Clean Docker CI and actual NAS installation follow this source checkpoint.

deploy/truenas.compose.yaml

@@ -0,0 +1,19 @@
+services:
+  dune:
+    image: ghcr.io/quintine/dune:checkpoint
+    init: true
+    restart: unless-stopped
+    environment:
+      DUNE_PUBLIC_ORIGIN: https://dune.procrastination.games
+    ports:
+      - "33046:3000"
+    volumes:
+      - dune-data:/data
+    stop_grace_period: 60s
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+volumes:
+  dune-data: