Fix what an independent review of the published repo turned up

- CI pinned Node 20, but `node --test` with type stripping needs 22.6, so the
  workflow could never have gone green. CI and `engines` now say 22.6.
- `docker compose up -d` failed on the documented path: the compose files
  require DB_PASSWORD and .env.example never mentioned it. Documented, and the
  README no longer claims "three secrets".
- The secret scanner treated any comment line as safe, so a pasted `.env`
  fragment — the usual way a key gets committed — slipped through. Verified
  against planted keys before and after.
- Module pages were not guarded: with KLARBILD_MODULES=print a signed-in user
  could still open /shares, /library and /queue and read about features the
  instance does not have. They now redirect, matching the API's 404 behaviour.
- German left in the English build: `bild.<ext>` as a download fallback, and
  31 t() keys with no German at all — the whole main navigation among them, so
  a German instance rendered its nav in English. Dictionary now covers every
  key in the source (1,067 entries).
- Third-party names removed from the data as well as the labels: the `theframe`
  format id is now `tv169`, and the dead Cricut admin field is gone.
- Dockerfile ignored the committed lockfile; it now copies it and uses `npm ci`.
- Dropped an unused dependency (@aws-sdk/s3-request-presigner — storage.ts
  explains why presigned URLs are not needed), a dead `/g/` entry in the
  unauthenticated path list, and an undocumented N8N_WEBHOOK_URL that nothing
  read. Documented TRUSTED_PROXIES, which the rate limiter does read.
- Migration 004 still had "nas" in its filename; README said A6–A2 where the
  list runs A6–A1; two committed screenshots were referenced nowhere.

124 tests green, type check clean, build clean, secret scan clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg

mcp/README.md

@@ -32,7 +32,7 @@ own tools) and then calls the Klarbild tools.
 - **process_images** — upload and process images (local paths or `data:` URLs).
   Give either `recipeId` (a preset) or `mode` (`each`/`compose`/`generate`) + options:
   `tasks` (`clean`/`cutout`/`format`/`contour`), `prompt_text`, `output_format`
-  (fixed, like `30x40`/`theframe`, **or custom**, `25x35` / `sticker5`), `output_ext`
+  (fixed, like `30x40`/`tv169`, **or custom**, `25x35` / `sticker5`), `output_ext`
   (`png`/`jpg`, omit = global default), `orientation`, `crop_mode`, `contour_mm`,
   `delivery_folder`, `delivery`. Returns the job ID.
 - **job_status** — query the status of a job (including finish time and error messages).

mcp/klarbild-mcp.mjs

@@ -54,7 +54,7 @@ const TOOLS = [
       tasks: { type: 'array', items: { type: 'string', enum: ['clean', 'cutout', 'format', 'contour'] },
         description: 'Only for mode=each. Default: ["format"] if output_format is set.' },
       prompt_text: { type: 'string', description: 'Description for compose/generate' },
-      output_format: { type: 'string', description: 'Fixed: 30x40, A4, theframe, portrait916, keep … OR custom: "25x35" (=25×35 cm) or "sticker5" (=5×5 cm).' },
+      output_format: { type: 'string', description: 'Fixed: 30x40, A4, tv169, portrait916, keep … OR custom: "25x35" (=25×35 cm) or "sticker5" (=5×5 cm).' },
       output_ext: { type: 'string', enum: ['png', 'jpg'], description: 'File format. Omit = global default setting. JPG only without transparency.' },
       orientation: { type: 'string', enum: ['portrait', 'landscape'] },
       crop_mode: { type: 'string', enum: ['crop', 'extend'] },