feat(appservice): mosaic-as daemon host + container (M4a deploy prep, agent-comms#9)

apps/appservice: framework-agnostic node:http daemon hosting
@mosaicstack/appservice — Synapse transactions endpoint passthrough,
internal bridge API v1 (messages/typing) with HMAC-digest timing-safe
bearer tokens, 1MiB request body cap, explicit 405 inside the
authenticated bridge block (no fall-through around auth), health endpoint,
env config, registration YAML printer bin. docker/appservice.Dockerfile
mirrors the gateway multi-stage pnpm/turbo pattern, runs as USER node
with container healthcheck. 9 vitest tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.woodpecker/publish.yml

@@ -114,31 +114,6 @@ steps:
     depends_on:
       - build
 
-  build-appservice:
-    image: gcr.io/kaniko-project/executor:debug
-    environment:
-      REGISTRY_USER:
-        from_secret: gitea_username
-      REGISTRY_PASS:
-        from_secret: gitea_password
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
-    commands:
-      - mkdir -p /kaniko/.docker
-      - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
-      - |
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/appservice:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:latest"
-        fi
-        if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:$CI_COMMIT_TAG"
-        fi
-        /kaniko/executor --context . --dockerfile docker/appservice.Dockerfile $DESTINATIONS
-    depends_on:
-      - build
-
   build-web:
     image: gcr.io/kaniko-project/executor:debug
     environment: