fix(diff): preserve E2E decryption key on label sync + add A/B line counters; uplift Docker

[mxhob1]

Summary

Two user-facing fixes plus a build uplift.

1. Encrypted share links break on refresh ("We couldn't decrypt your diff")

On the ?id= (end-to-end-encrypted) path the URL hash holds the AES decryption key (#s-…), not the diff payload. syncLabelsToUrl() fired when unzipCommitData() set the pane labels after decryption and replaceState'd the hash with the gzipped payload (#H4sI…). On refresh/re-copy, getE2EData() then read that payload as the key → decryption failed.

New pure helper buildLabelSyncUrl() returns null on the ?id= path so the key is never clobbered. Covered by helpers/labelSyncUrl.test.ts.

2. Per-side line counters

Adds an A / B line-count display with a colour-coded net delta (b − a) to the diff action bar, computed reactively from the store payload (matches the Monaco gutter). Hidden under 640px. Pure stats logic in helpers/lineStats.ts + tests.

3. Docker / engines uplift

• Build image node:22 → node:24 (current LTS); production nginx:1.27.0 (old mainline) → nginx:1.28.3-alpine-slim (current stable, pinned).
• engines.node 22.x → >=22; CI matrix node 20 → 22.
• Retained --openssl-legacy-provider (webpack 4 / MD4 vs OpenSSL 3) with an explanatory comment.

Test infra

Added @types/jest + tsconfig.jest.json so specs type-check without polluting the app build; *.test.ts excluded from the app tsconfig.

Verification

• npm test — 13 unit tests green (TDD).
• npm run build (nuxt generate, incl. fork-ts-checker) compiles clean; /diff route generates.
• eslint clean on changed files.
• Docker image build validated via a workflow_dispatch run of build-image on this branch (Node 24 / nginx 1.28).

🤖 Generated with Claude Code