Optimize CI build pipeline and harden .npmrc handling

- Fix Dockerfile dev-deps layer cache invalidation: copy only package manifests
  before npm ci so the layer is reused on code-only commits
- Skip QEMU by pinning platforms: linux/amd64 in build-push-action (~4 min saving)
- Replace manual actions/cache blocks with actions/setup-node cache: npm in
  test/typecheck/lint jobs (removes 3 duplicate 8-line blocks, pins Node 20)
- Pass .npmrc as a Docker BuildKit secret (--mount=type=secret) instead of
  COPYing it, so it can never leak into registry build-cache layers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/deploy.yml

@@ -35,6 +35,12 @@ jobs:
             - name: ⬇️ Checkout repo
               uses: https://github.com/actions/checkout@v4
 
+            - name: ⬆️ Setup Node
+              uses: https://github.com/actions/setup-node@v4
+              with:
+                  node-version: '20'
+                  cache: 'npm'
+
             - name: 📥 Install dependencies
               run: npm ci
 
@@ -52,6 +58,12 @@ jobs:
             - name: ⬇️ Checkout repo
               uses: https://github.com/actions/checkout@v4
 
+            - name: ⬆️ Setup Node
+              uses: https://github.com/actions/setup-node@v4
+              with:
+                  node-version: '20'
+                  cache: 'npm'
+
             - name: 📥 Install dependencies
               run: npm ci
 
@@ -66,6 +78,12 @@ jobs:
             - name: ⬇️ Checkout repo
               uses: https://github.com/actions/checkout@v4
 
+            - name: ⬆️ Setup Node
+              uses: https://github.com/actions/setup-node@v4
+              with:
+                  node-version: '20'
+                  cache: 'npm'
+
             - name: 📥 Install dependencies
               run: npm ci
 
@@ -100,9 +118,12 @@ jobs:
               with:
                   context: .
                   push: true
+                  platforms: linux/amd64
                   tags: ${{ vars.CONTAINER_REGISTRY }}/brackt:latest
                   cache-from: type=registry,ref=${{ vars.CONTAINER_REGISTRY }}/brackt:buildcache
                   cache-to: type=registry,ref=${{ vars.CONTAINER_REGISTRY }}/brackt:buildcache,mode=max
+                  secret-files: |
+                      npmrc=./.npmrc
 
     deploy:
         name: 🚀 Deploy

Dockerfile

@@ -1,12 +1,12 @@
 FROM node:20-alpine AS development-dependencies-env
-COPY . /app
+COPY package.json package-lock.json /app/
 WORKDIR /app
-RUN npm ci
+RUN --mount=type=secret,id=npmrc,target=/app/.npmrc npm ci
 
 FROM node:20-alpine AS production-dependencies-env
-COPY ./package.json package-lock.json .npmrc /app/
+COPY ./package.json package-lock.json /app/
 WORKDIR /app
-RUN npm ci --omit=dev
+RUN --mount=type=secret,id=npmrc,target=/app/.npmrc npm ci --omit=dev
 
 FROM node:20-alpine AS build-env
 COPY . /app/