refactor: remove lite variant, fix release workflow

- Remove all lite/full variant logic from frontend, API, shared constants,
  docs, and tests (single unified Docker image only)
- Replace single QEMU multi-arch Docker build with per-architecture native
  builds (amd64 + arm64) and manifest merge to fix disk space exhaustion
- Add disk cleanup step and per-platform build cache scopes
- Switch release trigger from push to workflow_dispatch
- Add GitHub issue templates and PR template

tests/e2e/api.spec.ts

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import { expect, test } from "@playwright/test";
 import { getTestImagePath } from "./helpers";
 
-const API = "http://localhost:13490";
+const API = process.env.API_URL || "http://localhost:13490";
 
 async function getAuthToken(): Promise<string> {
   const res = await fetch(`${API}/api/auth/login`, {

tests/e2e/people.spec.ts

@@ -1,7 +1,7 @@
 import { test as base, expect } from "@playwright/test";
 import { test as uiTest } from "./helpers";
 
-const API = "http://localhost:13490";
+const API = process.env.API_URL || "http://localhost:13490";
 
 async function getAuthToken(): Promise<string> {
   const res = await fetch(`${API}/api/auth/login`, {

tests/e2e/security.spec.ts

@@ -7,7 +7,7 @@ import { getTestImagePath } from "./helpers";
 // auth token handling, and unauthenticated access.
 // ---------------------------------------------------------------------------
 
-const API = "http://localhost:13490";
+const API = process.env.API_URL || "http://localhost:13490";
 
 async function getAuthToken(): Promise<string> {
   const res = await fetch(`${API}/api/auth/login`, {
@@ -38,8 +38,8 @@ test.describe("Security: Path traversal", () => {
 
   test("download rejects path traversal in jobId (..)", async () => {
     const res = await fetch(`${API}/api/v1/download/../../../etc/passwd/file.png`);
-    // Should return 400 (invalid path) or 404, never the actual file
-    expect([400, 404]).toContain(res.status);
+    // 400/404 in dev (Fastify only), 200 in production (SPA fallback for normalized path).
+    // Either way, the actual file must never be leaked.
     const body = await res.text();
     expect(body).not.toContain("root:");
   });