refactor: move source tree into work/, multi-stage Docker build, fix satpass

- Move all application source (meshai/, dashboard-frontend/, tests/,
  config/, docs/, Dockerfile, etc.) into work/ directory
- Add Node.js multi-stage build to Dockerfile for frontend compilation;
  remove compiled static assets from git tracking
- Fix satpass missing time windows: consolidation was splitting wire on
  newline and only putting line 1 in event.title, dropping the time
  window line that the composer uses for precomposed broadcasts
- Fix satpass burst flooding: stagger consolidation timers (+60s per
  pending pass) so Central batch publishes don't blast the mesh
- Update CI workflow build context to work/
- Anchor lib/ and data/ gitignore patterns to repo root to prevent
  false matches on nested directories
- Add dashboard-frontend/node_modules/ to .dockerignore

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

work/Dockerfile

@@ -0,0 +1,99 @@
+# MeshAI Dockerfile
+# LLM-powered Meshtastic assistant
+#
+# Build: docker build -t meshai .
+# Run:   docker run -d --name meshai \
+#          --device=/dev/ttyUSB0 \
+#          -p 7681:7681 \
+#          -v meshai_data:/data \
+#          meshai
+
+# ── Stage 1: Build frontend ──
+FROM node:20-alpine AS frontend
+WORKDIR /build
+COPY dashboard-frontend/ ./dashboard-frontend/
+WORKDIR /build/dashboard-frontend
+RUN npm ci && npm run build
+# Output lands at /build/meshai/dashboard/static/ (via vite outDir)
+
+# ── Stage 2: Python runtime ──
+FROM python:3.11-slim-bookworm
+
+LABEL maintainer="K7ZVX <matt@echo6.co>"
+LABEL description="MeshAI - LLM-powered Meshtastic assistant"
+LABEL version="0.1.0"
+LABEL org.opencontainers.image.source=https://github.com/zvx-echo6/meshai
+LABEL org.opencontainers.image.description="MeshAI - LLM-powered Meshtastic assistant"
+LABEL org.opencontainers.image.licenses=MIT
+
+# Build arguments
+ARG UID=1000
+ARG GID=1000
+
+# Environment variables
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    libc6-dev \
+    # For serial communication
+    udev \
+    # For health checks
+    curl \
+    # For process management
+    procps \
+    && rm -rf /var/lib/apt/lists/* \
+    # Install ttyd for web-based config interface (arch-aware)
+    && TTYD_ARCH=$(dpkg --print-architecture | sed 's/amd64/x86_64/' | sed 's/arm64/aarch64/') \
+    && curl -sL "https://github.com/tsl0922/ttyd/releases/download/1.7.7/ttyd.${TTYD_ARCH}" -o /usr/local/bin/ttyd \
+    && chmod +x /usr/local/bin/ttyd
+
+# Create non-root user
+RUN groupadd -g ${GID} meshai && \
+    useradd -u ${UID} -g ${GID} -m -s /bin/bash meshai && \
+    # Add to dialout group for serial access
+    usermod -aG dialout meshai
+
+# Create directories
+RUN mkdir -p /app /data && \
+    chown -R meshai:meshai /app /data
+
+WORKDIR /app
+
+# Copy requirements first for layer caching
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+# Pre-download embedding model for hybrid search
+RUN python3 -c "from fastembed import TextEmbedding; TextEmbedding('BAAI/bge-small-en-v1.5')"
+
+# Copy application code
+COPY --chown=meshai:meshai meshai/ ./meshai/
+# Overwrite with freshly built frontend assets from stage 1
+COPY --from=frontend --chown=meshai:meshai /build/meshai/dashboard/static/ ./meshai/dashboard/static/
+COPY --chown=meshai:meshai pyproject.toml .
+COPY --chown=meshai:meshai README.md .
+COPY --chown=meshai:meshai config.example.yaml .
+COPY --chown=meshai:meshai docker-entrypoint.sh .
+
+# Install the package
+RUN pip install --no-cache-dir -e .
+
+# Switch to non-root user
+USER meshai
+
+# Data volume mount point
+VOLUME ["/data"]
+
+# Expose ttyd web config port
+EXPOSE 7682 8080
+
+# Health check - verify bot process is alive via PID file
+HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
+    CMD test -f /tmp/meshai.pid && kill -0 $(cat /tmp/meshai.pid) 2>/dev/null || exit 1
+
+# Entrypoint handles config and ttyd
+ENTRYPOINT ["/app/docker-entrypoint.sh"]