ci: consume shared ci-python:3.14 image; bump runtime to 3.14

Migrate to the FabledRulebook CI-Runner contract:

- .forgejo/workflows/ci.yml: all four jobs (typecheck/lint/test/build)
  now schedule on the `python-ci` runner label and run inside
  container.image: git.fabledsword.com/bvandeusen/ci-python:3.14
  (Python 3.14 + Node 24 + ruff + uv + Docker CLI). Dropped the inline
  uv install in the test job — uv is now baked into the image.
- Dockerfile: production runtime bumped to python:3.14-slim so test
  results stay representative against what we ship.
- ci-requirements.md: new file at repo root declaring image deps and
  per-job installs (per FabledRulebook ci-runners.md).
- infra/Dockerfile.runner-base: deleted. The in-repo runner base
  (Ubuntu 24.04 + Python 3.12 + Node 22) is superseded by the shared
  ci-python image. The runner-host deployment files
  (runner-compose.yml + act-runner-config.yml) stay as deployment-shape
  documentation; source of truth is the deployed config.
- docs/development.md: CI/CD + Runner sections refreshed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ci-requirements.md

@@ -0,0 +1,49 @@
+# CI Requirements — FabledScribe
+
+> Spec lives in [`docs/process.md`](https://git.fabledsword.com/bvandeusen/CI-runner/src/branch/main/docs/process.md)
+> in the CI-Runner repo.
+
+## Runtime image
+
+```
+git.fabledsword.com/bvandeusen/ci-python:3.14
+```
+
+Used by all four jobs in `.forgejo/workflows/ci.yml`: typecheck (Vue/TS),
+lint (ruff), test (pytest), build (docker buildx).
+
+## Image deps used
+
+- python 3.14
+- node 24 (used for `npm ci` + `vue-tsc` in the typecheck job, and as the
+  frontend builder stage inside the production `Dockerfile`)
+- ruff (lint job runs `ruff check src/` with zero install overhead)
+- docker CLI + buildx (build job pushes the production image to the
+  Forgejo registry)
+
+## Per-job tool installs
+
+Anything CI installs at job time that isn't in the image. Promotion
+candidates if more than one project needs them.
+
+- `uv` — installed inline in the test job (`curl -LsSf
+  https://astral.sh/uv/install.sh | sh`). **Temporary**: belongs in the
+  ci-python image so every consumer doesn't re-install on cold start.
+  Tracked at [CI-Runner](https://git.fabledsword.com/bvandeusen/CI-runner).
+- `http-ece` is `--no-build-isolation`-installed before the editable
+  package install because http-ece doesn't declare `setuptools` as a
+  build dep and uv creates bare venvs without it. Not promotion-worthy
+  (one project, one wheel).
+
+## Notes
+
+- Production runtime image (`Dockerfile`) also tracks Python 3.14 — the
+  CI image and runtime image stay aligned by design so test results are
+  representative.
+- Build wall time: dominated by `pytest` (full async test suite). Cold
+  ci-python pulls add ~30s; not a blocker.
+- Registry-backed BuildKit layer cache (`type=registry,ref=…:cache,mode=max`)
+  gives ~80% speedup on warm builds — see the build job comment.
+- `pyproject.toml` keeps `requires-python = ">=3.12"` permissive so the
+  package can still be installed against older interpreters by external
+  consumers, but the CI/runtime target is 3.14.