Package verified Dune checkpoints for TrueNAS and HTTPS proxying

Serve built Workers directly through pinned Miniflare with persistent D1-compatible storage and startup migrations. Build and verify Docker images in CI; publish main checkpoints to GHCR for manual TrueNAS updates on port 33046. Preserve explicit public-origin checks and LAN-compatible cryptographic operation IDs.

Validation: 5,153 offline tests, typecheck, lint and build; 49 HTTP integration cases; HTTPS-origin create/join/chat/seat protection, foreign-origin rejection, exact saved-seat restart and browser asset serving. Independent persistence/proxy review completed. Clean Docker CI and actual NAS installation follow this source checkpoint.

package-lock.json

@@ -40,6 +40,7 @@
         "@vitejs/plugin-react": "6.0.2",
         "@vitejs/plugin-rsc": "0.5.26",
         "drizzle-kit": "0.31.10",
+        "miniflare": "4.20260515.0",
         "oxfmt": "0.61.0",
         "oxlint": "1.76.0",
         "oxlint-tsgolint": "7.0.2001",