Fix what an independent review of the published repo turned up

- CI pinned Node 20, but `node --test` with type stripping needs 22.6, so the
  workflow could never have gone green. CI and `engines` now say 22.6.
- `docker compose up -d` failed on the documented path: the compose files
  require DB_PASSWORD and .env.example never mentioned it. Documented, and the
  README no longer claims "three secrets".
- The secret scanner treated any comment line as safe, so a pasted `.env`
  fragment — the usual way a key gets committed — slipped through. Verified
  against planted keys before and after.
- Module pages were not guarded: with KLARBILD_MODULES=print a signed-in user
  could still open /shares, /library and /queue and read about features the
  instance does not have. They now redirect, matching the API's 404 behaviour.
- German left in the English build: `bild.<ext>` as a download fallback, and
  31 t() keys with no German at all — the whole main navigation among them, so
  a German instance rendered its nav in English. Dictionary now covers every
  key in the source (1,067 entries).
- Third-party names removed from the data as well as the labels: the `theframe`
  format id is now `tv169`, and the dead Cricut admin field is gone.
- Dockerfile ignored the committed lockfile; it now copies it and uses `npm ci`.
- Dropped an unused dependency (@aws-sdk/s3-request-presigner — storage.ts
  explains why presigned URLs are not needed), a dead `/g/` entry in the
  unauthenticated path list, and an undocumented N8N_WEBHOOK_URL that nothing
  read. Documented TRUSTED_PROXIES, which the rate limiter does read.
- Migration 004 still had "nas" in its filename; README said A6–A2 where the
  list runs A6–A1; two committed screenshots were referenced nowhere.

124 tests green, type check clean, build clean, secret scan clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg

README.md

@@ -22,7 +22,7 @@ nothing uploaded.
 
 ```bash
 git clone https://github.com/tillheidrich/klarbild.git && cd klarbild
-cp .env.example .env          # fill in three secrets, the file says which
+cp .env.example .env          # four values at the top; the file says which
 docker compose up -d
 docker compose logs app       # your admin password is printed here, once
 ```
@@ -42,7 +42,7 @@ output is a PDF laid out in millimetres, not a scaled bitmap, so 30 × 40 cm is
 **Sheet layout.** Put several pictures on one sheet at 100 % with crop marks:
 corner marks (0.25 pt, outside the trim) or continuous lines. Equal sizes snap to
 an exact grid; mixed sizes go through a MaxRects packer. Bleed 0–10 mm. 19 paper
-formats from A6 to A2 — including A3+ and photo paper 9 × 13 to 20 × 30, Letter
+formats from A6 to A1 — including A3+ and photo paper 9 × 13 to 20 × 30, Letter
 and Legal — or a custom sheet.
 
 **Pictures bigger than the sheet, handled three ways.** A 20 × 30 cm print on A4
@@ -149,7 +149,7 @@ the two tools worth knowing.
 ## Contributing
 
 [klarbild-demo.heidrich-digital.de](https://klarbild-demo.heidrich-digital.de) is the product
-page; its source is [klarbild-demo](https://git.heidrich-digital.de/till/klarbild-demo).
+page.
 
 Issues and pull requests are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md) for
 how the code is laid out and what the house style is. Security reports go to the