Run on Bun: bun install, bun --bun next, both dev2 sites on Bun (#222)

* Run on Bun: bun install, bun --bun next, both dev2 sites on Bun

Moves logicsrc.com and app.logicsrc.com (one image) off Node + npm onto Bun,
following the fleet recipe (phonenumbers.bot pilot).

- Package manager: bun.lock migrated from package-lock.json, so every resolved
  version is unchanged; packageManager bun@1.4.2. Root scripts run each
  workspace with `bun run --cwd <dir>` instead of `npm --workspace`.
- Bun 1.4.2, not the fleet's 1.4.0: 1.4.0 re-resolves this workspace's `file:`
  cross-references differently on every install, so its own lockfile never
  passes --frozen-lockfile. 1.4.2 is stable on it.
- Runtime: logicsrc-web runs `bun --bun next build/start`; apps/pwa (Express,
  app.logicsrc.com) runs `bun src/server.mjs`.
- Image: .nixpacks/Dockerfile (the path both dev2 compose stacks build) is now
  a hand-written oven/bun image carrying the whole workspace, run as the
  non-root bun user. ENTRYPOINT stays `bash -l -c` so a compose `command:` is
  one string, as before; app.logicsrc.com's compose starts it with
  "npm --workspace @logicsrc/pwa run start", which .nixpacks/npm (the image's
  only `npm`) turns into `bun run start` in apps/pwa. Port 3000, the PUBLIC_URL
  build arg and the / health path are unchanged. The nixpacks .nix and
  build.sh are gone.
- CI: both workflows install with bun and run every script through bun (Node
  stays only as the interpreter for vitest/tsc/node --test/Playwright, as
  before), and CI now boots the site under Bun.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* ci: boot check on port 3100 and stop it before Playwright needs 3000

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(web): keep next dev on port 5174, which Playwright waits on

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.nixpacks/npm

@@ -0,0 +1,28 @@
+#!/bin/sh
+# npm compatibility shim for the Bun image (see .nixpacks/Dockerfile).
+#
+# dev2's compose for app.logicsrc.com starts this image with the fixed command
+# string "npm --workspace @logicsrc/pwa run start" (rendered by cli-tools
+# dev2-site from the old Railway start command). The image has no Node and no
+# npm, so this translates exactly that shape, `npm [--workspace NAME] run
+# SCRIPT [ARGS...]`, into `bun run SCRIPT` inside the workspace's directory.
+# Anything else is refused loudly rather than guessed at.
+set -eu
+ROOT=/app
+ws=""
+if [ "${1:-}" = "--workspace" ] || [ "${1:-}" = "-w" ]; then ws=$2; shift 2; fi
+if [ "${1:-}" != "run" ] || [ $# -lt 2 ]; then
+  echo "npm shim: only 'npm [--workspace NAME] run SCRIPT' is supported (got: $*)" >&2
+  exit 64
+fi
+shift
+dir=$ROOT
+if [ -n "$ws" ]; then
+  dir=""
+  for pj in "$ROOT"/apps/*/package.json "$ROOT"/packages/*/package.json "$ROOT"/plugins/*/package.json; do
+    if grep -q "\"name\": *\"$ws\"" "$pj"; then dir=$(dirname "$pj"); break; fi
+  done
+  [ -n "$dir" ] || { echo "npm shim: no workspace named $ws" >&2; exit 66; }
+fi
+cd "$dir"
+exec bun run "$@"