ecarjat adds Gitea CI and production Docker stack for KairosVista TrueNAS

The deployment pieces are environment-specific: .gitea/workflows/docker-build.yaml builds with Buildx and pushes to registry.docker.home, while a top-level compose.yaml targets truenas.home. The frontend and backend Dockerfiles are upgraded from dev-mode containers to proper multi-stage builds - the backend compiles TypeScript and runs node dist/index.js; the frontend runs npm run build with Buildx secrets for SUPABASE_SECRET_KEY. A fail-fast check catches an empty NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY before the frontend build proceeds. These specifics should stay in ecarjat's repo.

The hardening in f78465c is more general. backend/src/lib/expressAsyncErrors.ts monkey-patches Express 4's router layer to forward unhandled promise rejections to error middleware - Express 4 doesn't do this natively, so async route handlers that throw would otherwise hang or crash. A top-level (err, req, res, next) handler now returns 500 JSON. requireAuth gets a try/catch so token verification errors return 503 rather than an unhandled exception. forcePathStyle in both backend/src/lib/storage.ts and frontend/src/lib/storage.ts is now controlled by R2_FORCE_PATH_STYLE rather than hardcoded. The JSONB fix in access.ts - .contains("shared_with", JSON.stringify([userEmail])) replacing .contains("shared_with", [userEmail]) - corrects a silent failure in project sharing queries.

One commit (3714194) adds R2_REGION=stub to work around an assumed Supabase S3 rejection, then 106c993 reverts it. The conclusion: region: "auto" works fine with Supabase Storage.

The final commit (f64dbcd) switches the frontend's baked-in URLs from truenas.home:8001/truenas.home:4001 to gateway.kairosvista.com and mike.kairosvista.com/api.