fix: copy serve.ts into the Docker build stage

The image build ran the tests without serve.ts present, so the server the
tests spawn never started and the hook stalled until it timed out. The
runtime stage would have failed on the same missing file immediately after.

The test now bails the moment the process exits and reports its stderr, so
this shows up as "serve.ts exited with 1 before listening" in 53ms rather
than an unexplained hook timeout after five seconds.

serve.ts is also in tsconfig's include now — it was outside it, so a type
error in the file that serves the app would only have surfaced at runtime.
Adding it immediately caught one in the test.

Verified by replaying the build stage against exactly the copied file set.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

.github/workflows/ci.yml

@@ -114,11 +114,26 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+  # Deploying to Pages needs two one-time steps that CI cannot do for itself:
+  #
+  #   1. Settings → Pages → Source: "GitHub Actions".
+  #      The default GITHUB_TOKEN cannot do this. Creating a Pages site needs
+  #      `administration: write`, which is not a permission a workflow can grant
+  #      GITHUB_TOKEN, so `configure-pages` with enablement: true fails with
+  #      "Resource not accessible by integration".
+  #   2. Settings → Secrets and variables → Actions → Variables:
+  #      set DEPLOY_PAGES to "true".
+  #
+  # Gated on that variable so the pipeline stays green for anyone who does not
+  # want Pages, rather than failing on every push forever.
   pages:
     name: Deploy to Pages
     runs-on: ubuntu-latest
     needs: build
-    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    if: >-
+      github.ref == 'refs/heads/main' &&
+      github.event_name != 'pull_request' &&
+      vars.DEPLOY_PAGES == 'true'
     permissions:
       pages: write
       id-token: write
@@ -131,12 +146,6 @@ jobs:
           name: site
           path: public
       - uses: actions/configure-pages@v5
-        with:
-          # Turn Pages on rather than requiring someone to click through
-          # repository settings first. Needs the pages: write permission above.
-          # If this still fails, Pages is unavailable for the repository —
-          # private repos on the free plan cannot use it; delete this job.
-          enablement: true
       - uses: actions/upload-pages-artifact@v3
         with:
           path: public