fix(ci): deploy client frontend on target node

src/deployment/nginxConfig.test.mjs

@@ -3,7 +3,26 @@ import { readFileSync } from 'node:fs'
 import test from 'node:test'
 
 const config = readFileSync(new URL('../../nginx/default.conf.template', import.meta.url), 'utf8')
+const jenkinsfile = readFileSync(new URL('../../Jenkinsfile', import.meta.url), 'utf8')
+const dockerfile = readFileSync(new URL('../../Dockerfile', import.meta.url), 'utf8')
 
 test('allows qualification uploads with multipart overhead through the API proxy', () => {
   assert.match(config, /location \/api\/ \{[\s\S]*?client_max_body_size 12m;/)
 })
+
+test('runs each deployment on its target node without controller-local SSH files', () => {
+  assert.match(jenkinsfile, /env\.JOB_BASE_NAME\?\.endsWith\('-dev'\) \? 'java-dev' : 'java-test'/)
+  assert.match(jenkinsfile, /docker compose -f "\$DEVELOPMENT_COMPOSE_FILE" up -d/)
+  assert.doesNotMatch(jenkinsfile, /\/var\/jenkins_home\/\.ssh|docker save|\bssh\b/)
+})
+
+test('uses authenticated internal base images in CI', () => {
+  assert.match(dockerfile, /ARG NODE_IMAGE=node:22-alpine/)
+  assert.match(dockerfile, /ARG NGINX_IMAGE=nginx:1\.27-alpine/)
+  assert.match(dockerfile, /FROM \$\{NODE_IMAGE\} AS build/)
+  assert.match(dockerfile, /FROM \$\{NGINX_IMAGE\}/)
+  assert.match(jenkinsfile, /NODE_BASE_IMAGE = '172\.31\.198\.7:10082\/java-project\/node:22-alpine'/)
+  assert.match(jenkinsfile, /NGINX_BASE_IMAGE = '172\.31\.198\.7:10082\/java-project\/nginx:1\.27-alpine'/)
+  assert.match(jenkinsfile, /withCredentials\(\[usernamePassword\(/)
+  assert.match(jenkinsfile, /export DOCKER_CONFIG="\$\{WORKSPACE\}@tmp\/docker-auth"/)
+})