Let the extension update itself, and host the dashboard

Chrome has no update channel for an unpacked extension, so every pull left one
manual step: click reload on its card. The dashboard now publishes the version
its own checkout ships at /api/autobuyer/status, and the extension reloads
itself when it is behind — chrome.runtime.reload() re-reads the folder from
disk, which the update check has already pulled into. It only ever runs code
that is on disk, so a reload that changes nothing is reported and waited out
rather than repeated; a dashboard that is behind is ignored.

Also adds the deploy stack for running the dashboard on the droplet, next to
the autotrader one: it joins that nginx's network and renders a server block
into its conf.d rather than standing up a second ingress. AUTOFIRMER_DB moves
the SQLite file onto a volume, since the working directory in a container is
replaced on every deploy.

And waitFor gained `hidden`: an absent gate matched on DOM presence only, so a
modal that closes by going display:none could never satisfy it. The extension
grew a visibility probe for this — locate cannot answer it, because absent and
hidden are both errors there and a wait gate has to tell them apart.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,67 @@
+# syntax=docker/dockerfile:1
+#
+# The hosted dashboard only. The clicker cannot run in here — it drives a real
+# mouse and keyboard and needs a desktop session — and neither can the
+# extension. Both stay on the Windows machine and talk to this over HTTPS.
+#
+# Debian rather than Alpine: better-sqlite3 publishes glibc prebuilds, and a
+# musl image would compile it from source on every build.
+
+# ── deps ─────────────────────────────────────────────────────────────────────
+FROM node:24-slim AS deps
+WORKDIR /app
+# Only used if npm cannot find a prebuilt better-sqlite3 for this Node ABI.
+RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ \
+    && rm -rf /var/lib/apt/lists/*
+COPY package.json package-lock.json ./
+RUN npm ci
+
+# ── prod deps ────────────────────────────────────────────────────────────────
+# A separate, dev-free install for the runtime image.
+FROM node:24-slim AS proddeps
+WORKDIR /app
+RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ \
+    && rm -rf /var/lib/apt/lists/*
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
+
+# ── build ────────────────────────────────────────────────────────────────────
+FROM node:24-slim AS builder
+WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN npm run build
+
+# ── run ──────────────────────────────────────────────────────────────────────
+FROM node:24-slim AS runner
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    PORT=3000 \
+    HOSTNAME=0.0.0.0 \
+    AUTOFIRMER_DB=/data/autotrader.sqlite
+
+RUN groupadd -g 1001 nodejs && useradd -u 1001 -g nodejs -m nextjs
+
+# The SQLite database lives here, on a named volume. Anything written inside the
+# image is thrown away on the next deploy, and WAL mode also needs to create
+# -wal and -shm files alongside the database, so the directory must be writable.
+RUN mkdir -p /data && chown nextjs:nodejs /data
+
+COPY --from=proddeps --chown=nextjs:nodejs /app/node_modules ./node_modules
+COPY --from=builder  --chown=nextjs:nodejs /app/.next ./.next
+COPY --chown=nextjs:nodejs package.json next.config.ts ./
+COPY --chown=nextjs:nodejs public ./public
+# /api/autobuyer/status reads the version out of this manifest and the extension
+# reloads itself to match, so the folder has to travel with the server.
+COPY --chown=nextjs:nodejs extension ./extension
+
+USER nextjs
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+    CMD node -e "fetch('http://127.0.0.1:3000/api/autobuyer/status').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["npm", "start"]