Rewrite as a Spring Boot app on the Bennett platform

Restores the real backend lost with Supabase (posts, authors, comments, subscriptions, admin) in
Postgres, seeds the existing markdown posts, and rebuilds the site as a Vite/React SPA served by
Spring — keeping the original styling (serif + tan accent) and content.

Dockerfile

@@ -1,24 +1,37 @@
 # syntax=docker/dockerfile:1
-FROM node:22-alpine AS deps
-WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci
 
-FROM node:22-alpine AS builder
-WORKDIR /app
-COPY --from=deps /app/node_modules ./node_modules
+# ---------- build ----------
+FROM maven:3.9-eclipse-temurin-25 AS build
+WORKDIR /src
 COPY . .
-ENV NEXT_TELEMETRY_DISABLED=1
-RUN npm run build
+# Resolve the platform from the Gitea Maven registry (creds via BuildKit secrets); the Maven build also
+# runs the Vite/React SPA build (frontend-maven-plugin) and folds it into the jar. Tests are skipped here
+# because Testcontainers needs a Docker daemon — they run via `mvn verify`, not in the image build.
+RUN --mount=type=secret,id=maven_user --mount=type=secret,id=maven_token \
+    MAVEN_USER="$(cat /run/secrets/maven_user)" MAVEN_TOKEN="$(cat /run/secrets/maven_token)" \
+    mvn -B -ntp -s .gitea/ci-settings.xml -DskipTests package \
+ && cp "$(ls target/confessions-of-grace-*.jar | grep -v original | head -1)" app.jar \
+ && java -Djarmode=tools -jar app.jar extract --layers --destination extracted
 
-FROM node:22-alpine AS runner
+# ---------- runtime ----------
+FROM eclipse-temurin:25-jre-alpine AS runtime
+RUN apk -U upgrade --no-cache && apk add --no-cache curl
+RUN addgroup -S spring && adduser -S -D -H -h /app -s /sbin/nologin -G spring spring
 WORKDIR /app
-ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=3000 HOSTNAME=0.0.0.0
-RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
-COPY --from=builder /app/public ./public
-COPY --from=builder /app/data ./data
-COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-USER nextjs
-EXPOSE 3000
-CMD ["node", "server.js"]
+
+COPY --from=build --chown=spring:spring /src/extracted/dependencies/ ./
+COPY --from=build --chown=spring:spring /src/extracted/snapshot-dependencies/ ./
+COPY --from=build --chown=spring:spring /src/extracted/application/ ./
+
+USER spring
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
+  CMD curl -fsS http://localhost:8080/actuator/health || exit 1
+
+ARG GIT_SHA=unknown
+LABEL org.opencontainers.image.title="confessions-of-grace" \
+      org.opencontainers.image.source="https://git.thebennett.net/reformedwitness/confessions-of-grace" \
+      org.opencontainers.image.revision="${GIT_SHA}"
+
+ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75.0", "-jar", "app.jar"]