Docker entrypoint can silently reuse a stale client build when vite envPrefix changes

The problem

docker-entrypoint.sh decides whether to skip the client rebuild by fingerprinting a hardcoded list of env vars (line 25):

FINGERPRINT="$(env | grep -E '^(VITE_|AUTH_MODE|BYPASS_EMAIL_VERIFICATION|POSTHOG_PUBLIC_KEY|POSTHOG_HOST|TURNSTILE_SITE_KEY|POSTHOG_SOURCEMAPS)' | sort | sha256sum | cut -d' ' -f1)"

That list has to mirror envPrefix in vite.config.ts (line 25), which is the real set Vite inlines into the client bundle. The only thing keeping them together today is the comment above it that says "keep in sync".

So: someone adds a prefix to envPrefix and doesn't touch the entrypoint. A self-hoster then changes that env var and restarts. The fingerprint doesn't move, the container prints "Reusing existing build (build-relevant env unchanged)", and serves a bundle with the old value baked in.

Nothing errors. The user sees a setting that appears to have no effect, and the build is the last place they would look.

What I'd want instead

Drift between those two lists fails CI.

A config-integrity unit test covers it: read both files, compare the two sets, allow an explicit build-only extras list (POSTHOG_SOURCEMAPS is the only one today). No runtime or build dependencies, runs in milliseconds.

Note

I have a working version of this in #213 - one file, src/shared/docker-entrypoint-env-sync.test.ts. Take it or ignore it; the issue is the part that matters. I'm closing that PR in line with the new contributing guide.