Compile the API instead of running its TypeScript in production.

The unit's ExecStart named src/index.ts, so every start depended on the host
having Node 22.18 or newer for native type stripping. A deploy onto a host with
Node 20 met ERR_UNKNOWN_FILE_EXTENSION, exited in under a second, and was
restarted 464 times over fifteen hours with nothing anywhere going red.

api/tsconfig.json now emits to api/dist. The source keeps its explicit .ts import
specifiers, which is what makes `node --watch src/index.ts` work in development;
rewriteRelativeImportExtensions turns them into .js on the way out, so what runs
in production is ordinary ESM that any Node from 20.18 up will start.

`pnpm build` builds shared, then api, then web. `pnpm dev` is unchanged.

deploy/ is tracked rather than ignored: the unit files are the thing an operator
copies to /etc/systemd/system, and the alert unit added next has to live
somewhere a deploy can find it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/cashumints-web.timer

@@ -0,0 +1,25 @@
+# /etc/systemd/system/cashumints-web.timer
+#
+# The nightly rebuild. Mint pages are prerendered, so a new mint or a new review count
+# appears at the next build; between builds the site stays correct because the islands
+# refresh status and reviews at runtime, and a mint indexed since the last build still
+# resolves through the client-side fallback on the 404 page.
+#
+#     sudo systemctl enable --now cashumints-web.timer
+#
+# The service it starts builds first and publishes second, so a failed build leaves the
+# running site untouched rather than replacing it with a half-written one.
+
+[Unit]
+Description=Nightly cashumints.space rebuild
+
+[Timer]
+OnCalendar=*-*-* 03:30:00
+# Run it on the next boot if the machine was off at 03:30, rather than skipping a day.
+Persistent=true
+# Without this every host rebuilds on the same second. Harmless with one VPS; free
+# insurance if there is ever a second.
+RandomizedDelaySec=15m
+
+[Install]
+WantedBy=timers.target