refactor: remove lite variant, fix release workflow

- Remove all lite/full variant logic from frontend, API, shared constants,
  docs, and tests (single unified Docker image only)
- Replace single QEMU multi-arch Docker build with per-architecture native
  builds (amd64 + arm64) and manifest merge to fix disk space exhaustion
- Add disk cleanup step and per-platform build cache scopes
- Switch release trigger from push to workflow_dispatch
- Add GitHub issue templates and PR template

tests/e2e/api.spec.ts

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import { expect, test } from "@playwright/test";
 import { getTestImagePath } from "./helpers";
 
-const API = "http://localhost:13490";
+const API = process.env.API_URL || "http://localhost:13490";
 
 async function getAuthToken(): Promise<string> {
   const res = await fetch(`${API}/api/auth/login`, {

tests/e2e/people.spec.ts

@@ -1,7 +1,7 @@
 import { test as base, expect } from "@playwright/test";
 import { test as uiTest } from "./helpers";
 
-const API = "http://localhost:13490";
+const API = process.env.API_URL || "http://localhost:13490";
 
 async function getAuthToken(): Promise<string> {
   const res = await fetch(`${API}/api/auth/login`, {

tests/e2e/security.spec.ts

@@ -7,7 +7,7 @@ import { getTestImagePath } from "./helpers";
 // auth token handling, and unauthenticated access.
 // ---------------------------------------------------------------------------
 
-const API = "http://localhost:13490";
+const API = process.env.API_URL || "http://localhost:13490";
 
 async function getAuthToken(): Promise<string> {
   const res = await fetch(`${API}/api/auth/login`, {
@@ -38,8 +38,8 @@ test.describe("Security: Path traversal", () => {
 
   test("download rejects path traversal in jobId (..)", async () => {
     const res = await fetch(`${API}/api/v1/download/../../../etc/passwd/file.png`);
-    // Should return 400 (invalid path) or 404, never the actual file
-    expect([400, 404]).toContain(res.status);
+    // 400/404 in dev (Fastify only), 200 in production (SPA fallback for normalized path).
+    // Either way, the actual file must never be leaked.
     const body = await res.text();
     expect(body).not.toContain("root:");
   });

tests/integration/content-aware-resize.test.ts

@@ -2,7 +2,7 @@
  * Integration tests for the content-aware resize (seam carving) API endpoint.
  *
  * This tool uses the Python sidecar, so in CI/test environments where Python
- * is not available the route will return 501 (lite mode) or 422 (Python error).
+ * is not available the route will return 422 (Python error).
  * Tests gracefully handle both scenarios while still verifying route existence
  * and input validation.
  */
@@ -49,9 +49,9 @@ describe("Content-Aware Resize", () => {
       body,
     });
 
-    // 200 = Python available, 422 = Python error, 501 = lite mode stub
+    // 200 = Python available, 422 = Python error
     // Any of these proves the route is registered and reachable
-    expect([200, 422, 501]).toContain(res.statusCode);
+    expect([200, 422]).toContain(res.statusCode);
   }, 60_000);
 
   it("rejects requests without a file", async () => {
@@ -88,8 +88,8 @@ describe("Content-Aware Resize", () => {
       body,
     });
 
-    // Accept 200 (Python available) or 422/501 (Python not available)
-    expect([200, 422, 501]).toContain(res.statusCode);
+    // Accept 200 (Python available) or 422 (Python not available)
+    expect([200, 422]).toContain(res.statusCode);
 
     if (res.statusCode === 200) {
       const resBody = JSON.parse(res.body);
@@ -114,7 +114,7 @@ describe("Content-Aware Resize", () => {
       body,
     });
 
-    expect([200, 422, 501]).toContain(res.statusCode);
+    expect([200, 422]).toContain(res.statusCode);
 
     if (res.statusCode === 200) {
       const resBody = JSON.parse(res.body);
@@ -139,10 +139,10 @@ describe("Content-Aware Resize", () => {
       body,
     });
 
-    // 422 = Python caught the enlargement error, 501 = lite mode
+    // 422 = Python caught the enlargement error
     // Should never be 200 since 400 > 200px source width
     expect(res.statusCode).not.toBe(200);
-    expect([422, 501]).toContain(res.statusCode);
+    expect(res.statusCode).toBe(422);
 
     if (res.statusCode === 422) {
       const resBody = JSON.parse(res.body);

tests/integration/lite-variant.test.ts

@@ -1,100 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import { buildTestApp, loginAsAdmin, type TestApp } from "./test-server.js";
-
-describe("Lite variant", () => {
-  let testApp: TestApp;
-  let app: TestApp["app"];
-  let adminToken: string;
-
-  beforeAll(async () => {
-    process.env.STIRLING_VARIANT = "lite";
-    testApp = await buildTestApp();
-    app = testApp.app;
-    adminToken = await loginAsAdmin(app);
-  }, 30_000);
-
-  afterAll(async () => {
-    delete process.env.STIRLING_VARIANT;
-    await testApp.cleanup();
-  }, 10_000);
-
-  describe("GET /api/v1/settings", () => {
-    it("includes variant and variantUnavailableTools", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: "/api/v1/settings",
-        headers: { authorization: `Bearer ${adminToken}` },
-      });
-
-      expect(res.statusCode).toBe(200);
-      const body = JSON.parse(res.body);
-      expect(body.variant).toBe("lite");
-      expect(body.variantUnavailableTools).toEqual([
-        "remove-background",
-        "upscale",
-        "blur-faces",
-        "erase-object",
-        "ocr",
-        "content-aware-resize",
-      ]);
-    });
-  });
-
-  describe("AI tool routes return 501", () => {
-    const aiTools = [
-      "remove-background",
-      "upscale",
-      "blur-faces",
-      "erase-object",
-      "ocr",
-      "content-aware-resize",
-    ];
-
-    for (const toolId of aiTools) {
-      it(`POST /api/v1/tools/${toolId} returns 501`, async () => {
-        const res = await app.inject({
-          method: "POST",
-          url: `/api/v1/tools/${toolId}`,
-          headers: { authorization: `Bearer ${adminToken}` },
-          payload: {},
-        });
-
-        expect(res.statusCode).toBe(501);
-        const body = JSON.parse(res.body);
-        expect(body.error).toBe("Not Available");
-        expect(body.message).toContain("full image");
-      });
-    }
-  });
-
-  describe("Sharp tools still work in lite mode", () => {
-    it("POST /api/v1/tools/info returns 200 with valid image", async () => {
-      const { readFileSync } = await import("node:fs");
-      const { join } = await import("node:path");
-      const { fileURLToPath } = await import("node:url");
-      const __dirname = join(fileURLToPath(import.meta.url), "..");
-      const png = readFileSync(join(__dirname, "..", "fixtures", "test-200x150.png"));
-
-      const boundary = "----TestBoundary";
-      const body = Buffer.concat([
-        Buffer.from(
-          `--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="test.png"\r\nContent-Type: image/png\r\n\r\n`,
-        ),
-        png,
-        Buffer.from(`\r\n--${boundary}--\r\n`),
-      ]);
-
-      const res = await app.inject({
-        method: "POST",
-        url: "/api/v1/tools/info",
-        headers: {
-          authorization: `Bearer ${adminToken}`,
-          "content-type": `multipart/form-data; boundary=${boundary}`,
-        },
-        payload: body,
-      });
-
-      expect(res.statusCode).toBe(200);
-    });
-  });
-});