Initial StartOS package for Station Master (v0.5.1)

Built from source via a git submodule pinned to a tag, not a published image
— the Dockerfile, main.ts, and manifest should never need to change for an
ordinary version bump, only the submodule pin (see UPDATING.md). One volume,
one interface serving the browser client + lobby/intent API + SSE stream
from a single origin, no dependencies. The server-wide join secret (D14) is
seeded on install, exposed via the Get Join Secret action, and blocks start
behind a critical task until retrieved — the same first-set/rotation pattern
as actual-budget-startos's admin password.

Verified on phoenix.local: installs, the critical task correctly blocks an
ordinary start, force-starting confirms the daemon binds its port and serves
the client, and store.json correctly holds the install-seeded join secret.
Not verified: the Get Join Secret action's execution end-to-end — start-cli's
`package action run` fails with a client-side deserialization error that
reproduces identically against actual-budget's already-shipped equivalent
action, so this looks like a start-cli issue rather than a defect here.

icon.svg is still the scaffold's hello-world placeholder — no real Station
Master icon exists yet to ship in its place.

Dockerfile

@@ -0,0 +1,23 @@
+# Station Master's multiplayer server, built from source — there is no published image to wrap.
+# Source is the `station-master` git submodule, pinned to a tag; see UPDATING.md for how that pin
+# is bumped. This Dockerfile never needs to change for a version bump, only the submodule ref.
+
+# --- builder: produces the static browser client (dist/) ---
+# The server itself has zero runtime dependencies (station-master/TODO.md), but `npm run
+# build:web` shells out to `tsc`, which lives in devDependencies — hence the separate stage.
+FROM node:22.23.1-slim AS builder
+WORKDIR /build
+COPY station-master/package.json station-master/package-lock.json ./
+RUN npm ci
+COPY station-master/ ./
+RUN npm run build:web
+
+# --- runtime: the server, no node_modules needed at all ---
+FROM node:22.23.1-slim
+WORKDIR /app
+# Node >=22.18 strips TypeScript types natively (station-master/package.json's engines field),
+# so the server runs straight from source with no build/compile step.
+COPY station-master/package.json ./
+COPY station-master/src/ ./src/
+COPY --from=builder /build/dist/ ./dist/
+CMD ["node", "src/server/index.ts"]