refactor: move source tree into work/, multi-stage Docker build, fix satpass

- Move all application source (meshai/, dashboard-frontend/, tests/,
  config/, docs/, Dockerfile, etc.) into work/ directory
- Add Node.js multi-stage build to Dockerfile for frontend compilation;
  remove compiled static assets from git tracking
- Fix satpass missing time windows: consolidation was splitting wire on
  newline and only putting line 1 in event.title, dropping the time
  window line that the composer uses for precomposed broadcasts
- Fix satpass burst flooding: stagger consolidation timers (+60s per
  pending pass) so Central batch publishes don't blast the mesh
- Update CI workflow build context to work/
- Anchor lib/ and data/ gitignore patterns to repo root to prevent
  false matches on nested directories
- Add dashboard-frontend/node_modules/ to .dockerignore

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

work/docs/handoff_2026-06-09.md

@@ -0,0 +1,55 @@
+# MeshAI Handoff — 2026-06-09
+
+## Container Architecture
+
+The MeshAI Docker container (`meshai`) does **not** bind-mount `/opt/meshai`
+into the container. The only mount is:
+
+    meshai_data:/data   (persistent SQLite DB + config)
+
+The Python source and frontend bundle are **baked into the image** at
+build time via `COPY` in the Dockerfile.
+
+## DEPLOY (ALL changes — Python or frontend)
+
+```bash
+sudo docker compose build meshai && sudo docker compose up -d
+```
+
+**Python-only shortcut does NOT exist** — the repo is not bind-mounted
+into the container. A bare `restart` re-execs the baked image; your `.py`
+change will not load. Always use `build + up`.
+
+### Verify Python changes loaded after build
+
+```bash
+sudo docker logs meshai --tail 20
+```
+(look for import errors or the handler name in startup logs)
+
+### Verify frontend bundle shipped after build
+
+```bash
+sudo docker exec meshai cat /app/meshai/dashboard/static/index.html \
+  | grep assets/index
+```
+(confirm hash changed from prior build)
+
+## Session Changes (feature/mesh-intelligence)
+
+| Commit | Description |
+|--------|-------------|
+| `ae884b9` | Avalanche multi-line wire format, danger-level re-emit, GUI panel |
+| `bf5b346` | Avalanche wire format — use `_meshai_precomposed` bypass |
+| `5624a0b` | Wire avalanche to CENTRAL_AVY — central handler + consumer routing |
+| `a9d4ede` | Nullsafe `broadcast_pager_alerts` in quake panel |
+| `8e810d6` | Enable central feed source toggle for avalanche adapter |
+| `376b0db` | Add `reminders_wfigs.enabled` kill switch, default disabled |
+| `862d2dc` | Auto-cleanup stale fires (>7d unflagged + >30d tombstones hourly) |
+| `45ca536` | Fire digest — tighter format, 220-byte budget, 7d freshness gate |
+
+## Open Items
+
+- **Avalanche danger_level scale**: TODO in `avy_handler.py` — verify
+  Central's `data.data.danger_level` uses NAADS 5-point scale before
+  flipping `feed_source="central"`. See docstring for details.