M1 웹 + 배포: 홈·코드 입장·대기실·오목 화면·결과·계정, E2E, Docker/Caddy

- 웹(React+Vite): 홈(큰 버튼 2개·하던 게임 돌아가기), 6자리 코드 입력(붙여넣기 감지·자동 입장),
  링크 입장(닉네임 한 칸), 대기실(코드/링크 복사·공유·QR·자리·준비·방장 메뉴·설정),
  오목(SVG 판·두 번 눌러 확정·금수/위험 표시·시계·무르기·무승부·기권·키보드 조작·스크린리더 안내),
  결과(한 판 더 투표·방 전적·공정성 확인), 채팅·반응, 계정(닉네임 변경·글자 크기·테마·소리·진동)
- WS 클라이언트: 지수 백오프+지터 재연결, 화면 복귀/온라인 즉시 재연결, seq 순서 처리,
  ping/pong 지연·시계 보정, 서버 재시작 안내, 다른 창 접속 처리
- @bg/shared/lite: 브라우저용 진입점(zod 제외) → 첫 화면 JS 약 90KB gzip
- e2e/omok.e2e.ts: 브라우저 두 개(모바일·PC)로 방 만들기→링크 입장→대국→새로고침 복구→승리→한 판 더
- deploy: Dockerfile(운영 의존성만, 267MB), docker-compose(app+Caddy), Caddyfile(보안 헤더·CSP), .env.example
- 프록시 뒤에서만 X-Forwarded-For 신뢰(TRUST_PROXY=1)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/.env.example

@@ -0,0 +1,9 @@
+# Copy to deploy/.env and fill in. Never commit the real file.
+SITE_DOMAIN=game.example.com
+PUBLIC_ORIGIN=https://game.example.com
+# 32+ random characters: openssl rand -base64 48
+SESSION_SECRET=
+# Discord developer portal → OAuth2 (redirect: https://<domain>/api/auth/discord/callback). Leave empty to hide Discord login.
+DISCORD_CLIENT_ID=
+DISCORD_CLIENT_SECRET=
+LOG_LEVEL=info

deploy/Caddyfile

@@ -0,0 +1,17 @@
+{$SITE_DOMAIN} {
+	encode zstd gzip
+
+	# Internal metrics/health detail must not be public.
+	respond /internal/* 404
+
+	header {
+		Strict-Transport-Security "max-age=31536000"
+		X-Content-Type-Options "nosniff"
+		Referrer-Policy "strict-origin-when-cross-origin"
+		Content-Security-Policy "default-src 'self'; img-src 'self' https://cdn.discordapp.com data:; connect-src 'self' wss://{$SITE_DOMAIN}; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
+		-Server
+	}
+
+	# The app serves the built web assets with long-lived caching for /assets/* and no-cache for index.html.
+	reverse_proxy app:3000
+}

deploy/Dockerfile

@@ -0,0 +1,35 @@
+# Multi-stage build: install → build web → slim runtime (docs/11-deployment-ops.md)
+FROM oven/bun:1.3 AS build
+WORKDIR /app
+COPY package.json bun.lock bunfig.toml tsconfig.base.json ./
+COPY packages ./packages
+COPY apps ./apps
+RUN bun install --frozen-lockfile
+RUN cd apps/web && bunx vite build
+
+# Production-only dependencies (no vite/typescript/playwright in the runtime image).
+FROM oven/bun:1.3 AS deps
+WORKDIR /app
+COPY package.json bun.lock bunfig.toml ./
+COPY packages/engine/package.json packages/engine/
+COPY packages/shared/package.json packages/shared/
+COPY packages/games/package.json packages/games/
+COPY apps/server/package.json apps/server/
+COPY apps/web/package.json apps/web/
+RUN bun install --frozen-lockfile --production --filter '@bg/server'
+
+FROM oven/bun:1.3-slim
+WORKDIR /app
+ENV NODE_ENV=production PORT=3000 DB_PATH=/data/app.db TRUST_PROXY=1
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=build /app/package.json ./package.json
+COPY --from=build /app/packages ./packages
+COPY --from=build /app/apps/server ./apps/server
+COPY --from=build /app/apps/web/dist ./apps/web/dist
+RUN mkdir -p /data && chown bun:bun /data
+USER bun
+VOLUME ["/data"]
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD bun -e "fetch('http://localhost:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+STOPSIGNAL SIGTERM
+CMD ["bun", "apps/server/src/index.ts"]

deploy/docker-compose.yml

@@ -0,0 +1,33 @@
+services:
+  app:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile
+    image: boardgame-site:${APP_VERSION:-latest}
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      TRUST_PROXY: "1"
+    volumes:
+      - app-data:/data
+    stop_grace_period: 15s
+    logging:
+      driver: json-file
+      options: { max-size: "50m", max-file: "5" }
+
+  caddy:
+    image: caddy:2
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      SITE_DOMAIN: ${SITE_DOMAIN:?set SITE_DOMAIN in deploy/.env}
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+    depends_on: [app]
+
+volumes:
+  app-data:
+  caddy-data: