fix(gateway): gate FederationModule on tier federated (#1138)

CaService hard-requires STEP_CA_URL/provisioner config at construction, so an
unconditional FederationModule import makes every standalone/local boot die at
DI time. Gate the module on loadConfig().tier === federated, matching the
documented intent of the federation compose profile (must not start in
non-federated dev).

Verified in mosaic-dev box: standalone tier boots to "Gateway listening on
port 14242" with bootstrap/socket.io/auth surfaces responding; federated tier
path unchanged.

apps/gateway/src/app.module.ts

@@ -26,6 +26,13 @@ import { WorkspaceModule } from './workspace/workspace.module.js';
 import { QueueModule } from './queue/queue.module.js';
 import { FederationModule } from './federation/federation.module.js';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
+import { loadConfig } from '@mosaicstack/config';
+
+// Federation (step-ca client, enrollment, federation verbs) is only wired for
+// tier 'federated' — CaService hard-requires STEP_CA_* at construction, which
+// must not gate standalone/local boots (docker-compose.federated.yml: the
+// federation profile "must not start in non-federated dev").
+const federationEnabled = loadConfig().tier === 'federated';
 
 @Module({
   imports: [
@@ -53,7 +60,7 @@ import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
     QueueModule,
     ReloadModule,
     WorkspaceModule,
-    FederationModule,
+    ...(federationEnabled ? [FederationModule] : []),
   ],
   controllers: [HealthController],
   providers: [

docker/web.Dockerfile

@@ -8,11 +8,9 @@ WORKDIR /app
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
 COPY apps/web/package.json ./apps/web/
 COPY packages/ ./packages/
-# the root prepare script runs scripts/install-hooks.mjs on install
-COPY scripts/ ./scripts/
 RUN pnpm install --frozen-lockfile
 COPY . .
-RUN pnpm --filter @mosaicstack/web build
+RUN pnpm --filter @mosaic/web build
 
 FROM base AS runner
 WORKDIR /app

scripts/install-hooks.mjs

@@ -75,16 +75,6 @@ export async function installHooks({
 } = {}) {
   if (disabled) return;
 
-  try {
-    await execFileAsync('git', ['--version']);
-  } catch (error) {
-    if (error.code === 'ENOENT') {
-      console.warn('git not found; skipping hook installation');
-      return;
-    }
-    throw error;
-  }
-
   const huskyDir = path.join(root, '.husky');
   const active = path.join(huskyDir, '_');
   const nonce = `${Date.now()}-${process.pid}`;