ops: Podman confirmed + build conventions (pnpm/pm2/LTS) + nice-to-have add-ons todo

STATUS.md

@@ -27,9 +27,25 @@ re-register, board re-flashes; **only Forgejo data migrates**) → validate →
 - **Decisions locked:** data = **pooled + `tenant_id`** (RLS later); broker = **Mosquitto** + per-device **tokens** validated via `mosquitto-go-auth` Postgres backend; **per-tenant device quota**; auth/sessions/passwords already in Postgres (Better-Auth tables `users/sessions/accounts/verifications` + `user_dashboard_prefs`); **relay/bridge = LAST**.
 - FW now publishes **~3 s cadence** (clean, oversampled) → on new box store **full-res raw** + Timescale compression (no old noise-decimation throttle needed).
 
-## ⛔ PENDING DECISION (blocks the next step)
-**Container runtime for CI.** Old Forgejo = **Docker** (`forgejo:11` + `forgejo/runner:6`, **SQLite** at `/home/dahlner-git/services/forgejo/data`, compose `/home/dahlner-git/services/forgejo/docker-compose.yml`). The CI runner builds **firmware inside ESP-IDF containers**, so the new box needs a container runtime — conflicts with the earlier "no Docker" goal.
-**Recommendation (awaiting KJ "Podman OK"):** install **Podman (rootless)** on the new box for **Forgejo + runner + build jobs only**; cloud stack stays **native**. Cloud-deploy job = **host runner** (no container); FW build job = Podman container.
+## ✅ Container runtime: Podman (rootless) — KJ CONFIRMED
+For **Forgejo + CI runner + FW build jobs only**; cloud stack stays **native**.
+Cloud-deploy job = **host runner** (no container); FW build job = Podman container.
+Old Forgejo to copy = Docker `forgejo:11` + `forgejo/runner:6`, **SQLite** at
+`/home/dahlner-git/services/forgejo/data`, compose
+`/home/dahlner-git/services/forgejo/docker-compose.yml`.
+
+## Build/runtime conventions
+- **pnpm** (corepack) for install/build (`pnpm install` + `pnpm -r build`); **pm2** runs the built Node entry in **cluster** mode. NOT npm.
+- **Node 22 LTS** (best-practice = LTS, not bleeding edge). Stack already on latest majors: Astro 5 · Tailwind 4 · DaisyUI 5 · drizzle · Better-Auth 1 · Caddy 2.11 · TimescaleDB 2.27 · Mosquitto 2.0. During deploy run `pnpm update` to latest-compatible + flag any worthwhile major bumps (no blind breaking upgrades).
+
+## Nice-to-have add-ons (TODO — KJ to greenlight)
+- **Uptime Kuma** → `status.cannabuddy.eu` (already planned).
+- **GlitchTip** (self-host, Sentry-API compatible) — app error tracking; high value for prod.
+- **Beszel** — lightweight server+DB metrics dashboard (the "custom dashboard" instead of Netdata).
+- **Umami** — privacy-friendly analytics (landing + app).
+- **Healthchecks** (self-host) — alerts if the nightly backup/cron didn't run.
+- **restic** → R2 for backups (dedup + encryption + retention; nicer than raw pg_dump+rclone).
+- Later: **Infisical** (self-host secrets manager) to move secrets out of git.
 
 ## NEXT (once Podman confirmed)
 1. Install Podman (rootless).