fix(observability): switch source map upload to glitchtip-cli

@sentry/vite-plugin uses sentry-cli which creates release entries but
doesn't upload files to GlitchTip's API correctly. Switch to the native
glitchtip-cli which uses the debug ID inject+upload approach that
GlitchTip actually supports.

.gitea/workflows/release.yaml

@@ -158,12 +158,31 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Build with source maps and upload to GlitchTip
-        env:
-          SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-          BUILD_VERSION: ${{ gitea.ref_name }}
+      - name: Build with source maps
         run: npm run build
 
+      - name: Download glitchtip-cli
+        run: |
+          curl -L https://gitlab.com/glitchtip/glitchtip-cli/-/releases/permalink/latest/downloads/glitchtip-cli-x86_64-unknown-linux-musl \
+            -o /usr/local/bin/glitchtip-cli
+          chmod +x /usr/local/bin/glitchtip-cli
+
+      - name: Inject debug IDs into build artifacts
+        run: glitchtip-cli sourcemaps inject ./build
+        env:
+          SENTRY_URL: https://errors.libnovel.cc/
+          SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
+          SENTRY_ORG: libnovel
+          SENTRY_PROJECT: libnovel-ui
+
+      - name: Upload source maps to GlitchTip
+        run: glitchtip-cli sourcemaps upload ./build --release ${{ gitea.ref_name }}
+        env:
+          SENTRY_URL: https://errors.libnovel.cc/
+          SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
+          SENTRY_ORG: libnovel
+          SENTRY_PROJECT: libnovel-ui
+
   # ── docker: ui ────────────────────────────────────────────────────────────────
   docker-ui:
     name: Docker / ui

Caddyfile

@@ -30,6 +30,7 @@
 #   logs.libnovel.cc               → dozzle:8080   (Docker log viewer)
 #   uptime.libnovel.cc             → uptime-kuma:3001  (uptime monitoring)
 #   push.libnovel.cc               → gotify:80     (push notifications)
+#   search.libnovel.cc             → meilisearch:7700  (search index — homelab runner)
 #
 # Routes intentionally removed from direct-to-backend:
 #   /api/scrape/*                  — SvelteKit has /api/scrape/ counterparts
@@ -254,3 +255,12 @@ storage.libnovel.cc {
 	reverse_proxy minio:9000
 }
 
+# ── Meilisearch: exposed for homelab runner search indexing ──────────────────
+# The homelab runner connects here as MEILI_URL to index books after scraping.
+# Protected by MEILI_MASTER_KEY bearer token — Meilisearch enforces auth on
+# every request; Caddy just terminates TLS.
+search.libnovel.cc {
+	import security_headers
+	reverse_proxy meilisearch:7700
+}
+}

homelab/runner/docker-compose.yml

@@ -8,7 +8,8 @@
 #   - RUNNER_WORKER_ID=homelab-runner-1  (unique, avoids task claiming conflicts)
 #   - MINIO_ENDPOINT/USE_SSL → storage.libnovel.cc over HTTPS
 #   - POCKETBASE_URL          → https://pb.libnovel.cc
-#   - MEILI_URL/VALKEY_ADDR   → unset (not exposed publicly; not needed by runner)
+#   - MEILI_URL               → https://search.libnovel.cc (Caddy-proxied)
+#   - VALKEY_ADDR             → unset (not exposed publicly)
 #   - RUNNER_SKIP_INITIAL_CATALOGUE_REFRESH=true
 
 services:
@@ -30,9 +31,12 @@ services:
       MINIO_PUBLIC_ENDPOINT: "${MINIO_PUBLIC_ENDPOINT}"
       MINIO_PUBLIC_USE_SSL: "${MINIO_PUBLIC_USE_SSL}"
 
-      # ── Meilisearch / Valkey — not exposed, disabled ────────────────────────
-      MEILI_URL: ""
+      # ── Meilisearch (via search.libnovel.cc Caddy proxy) ────────────────────
+      MEILI_URL: "${MEILI_URL}"
+      MEILI_API_KEY: "${MEILI_API_KEY}"
       VALKEY_ADDR: ""
+      # Force IPv4 DNS resolution — homelab has no IPv6 route to search.libnovel.cc
+      GODEBUG: "preferIPv4=1"
 
       # ── Kokoro TTS ──────────────────────────────────────────────────────────
       KOKORO_URL: "${KOKORO_URL}"

ui/vite.config.ts

@@ -1,36 +1,14 @@
 import { sveltekit } from '@sveltejs/kit/vite';
 import tailwindcss from '@tailwindcss/vite';
 import { defineConfig } from 'vite';
-import { sentryVitePlugin } from '@sentry/vite-plugin';
 
 // Source maps are always generated so that the CI pipeline can upload them to
-// GlitchTip after a release build. The sentryVitePlugin upload step is only
-// active when SENTRY_AUTH_TOKEN is present (i.e. in the release CI job).
+// GlitchTip via glitchtip-cli after a release build.
 export default defineConfig({
 	build: {
 		sourcemap: true
 	},
-	plugins: [
-		tailwindcss(),
-		sveltekit(),
-		sentryVitePlugin({
-			org: 'libnovel',
-			project: 'libnovel-ui',
-			url: 'https://errors.libnovel.cc/',
-			// Auth token injected by CI via SENTRY_AUTH_TOKEN env var.
-			// When the env var is absent the plugin is a no-op.
-			authToken: process.env.SENTRY_AUTH_TOKEN,
-			// Release name matches the Docker image tag (e.g. "1.2.3").
-			release: { name: process.env.BUILD_VERSION },
-			// Don't upload source maps in local dev or CI type-check jobs.
-			disable: !process.env.SENTRY_AUTH_TOKEN,
-			// Source maps are uploaded to GlitchTip; do not ship them in the
-			// production bundle served to browsers.
-			sourceMapsUploadOptions: {
-				filesToDeleteAfterUpload: ['./build/**/*.map']
-			}
-		})
-	],
+	plugins: [tailwindcss(), sveltekit()],
 	ssr: {
 		// Force these packages to be bundled into the server output rather than
 		// treated as external requires. The production Docker image has no