Fix what an independent review of the published repo turned up

- CI pinned Node 20, but `node --test` with type stripping needs 22.6, so the
  workflow could never have gone green. CI and `engines` now say 22.6.
- `docker compose up -d` failed on the documented path: the compose files
  require DB_PASSWORD and .env.example never mentioned it. Documented, and the
  README no longer claims "three secrets".
- The secret scanner treated any comment line as safe, so a pasted `.env`
  fragment — the usual way a key gets committed — slipped through. Verified
  against planted keys before and after.
- Module pages were not guarded: with KLARBILD_MODULES=print a signed-in user
  could still open /shares, /library and /queue and read about features the
  instance does not have. They now redirect, matching the API's 404 behaviour.
- German left in the English build: `bild.<ext>` as a download fallback, and
  31 t() keys with no German at all — the whole main navigation among them, so
  a German instance rendered its nav in English. Dictionary now covers every
  key in the source (1,067 entries).
- Third-party names removed from the data as well as the labels: the `theframe`
  format id is now `tv169`, and the dead Cricut admin field is gone.
- Dockerfile ignored the committed lockfile; it now copies it and uses `npm ci`.
- Dropped an unused dependency (@aws-sdk/s3-request-presigner — storage.ts
  explains why presigned URLs are not needed), a dead `/g/` entry in the
  unauthenticated path list, and an undocumented N8N_WEBHOOK_URL that nothing
  read. Documented TRUSTED_PROXIES, which the rate limiter does read.
- Migration 004 still had "nas" in its filename; README said A6–A2 where the
  list runs A6–A1; two committed screenshots were referenced nowhere.

124 tests green, type check clean, build clean, secret scan clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg

migrations/004_modes_thumbs_storage_backup.sql

@@ -0,0 +1,35 @@
+-- Klarbild — Generation modes, thumbnails, storage management, backup mirror.
+-- (04) Combining several images + free-text generation, thumbnails for the
+--      library, "don't clutter up the server" (retention / deleting sources), a
+--      second backup to a backup mirror.
+
+-- Job mode: each = every template on its own (as before), compose = several images
+-- + text into ONE new image, generate = pure free text without a template.
+ALTER TABLE jobs ADD COLUMN IF NOT EXISTS mode text NOT NULL DEFAULT 'each'
+  CHECK (mode IN ('each','compose','generate'));
+
+-- Items: several source images (compose) + a shrunk preview image.
+ALTER TABLE items ADD COLUMN IF NOT EXISTS source_paths jsonb;
+ALTER TABLE items ADD COLUMN IF NOT EXISTS thumb_path text;
+
+-- Preset recipes can pre-set a mode (for default Telegram presets).
+ALTER TABLE recipes ADD COLUMN IF NOT EXISTS mode text NOT NULL DEFAULT 'each'
+  CHECK (mode IN ('each','compose','generate'));
+
+-- Storage management ---------------------------------------------------------
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS keep_sources   bool NOT NULL DEFAULT true;
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS make_thumbnails bool NOT NULL DEFAULT true;
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS retention_days int;   -- NULL = unlimited
+
+-- Second backup to a backup mirror (SFTP/FTPS, same as the delivery target) ---
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS mirror_enabled      bool NOT NULL DEFAULT false;
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS mirror_host         text;
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS mirror_protocol     text CHECK (mirror_protocol IN ('ftps','sftp'));
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS mirror_port         int;
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS mirror_user         text;
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS mirror_password_enc text;
+ALTER TABLE settings ADD COLUMN IF NOT EXISTS mirror_base_path    text;
+
+-- Mirror status per item (for visibility/retrying).
+ALTER TABLE items ADD COLUMN IF NOT EXISTS mirror_status text NOT NULL DEFAULT 'none'
+  CHECK (mirror_status IN ('none','pending','mirrored','failed'));