Ship brightsign/ in the image — the player assets 404 in a container

The player loads /player/st-bridge.js and /player/st-sync.js, both served from
../brightsign so the copy the player runs can never drift from the copy sitting
on the player's own storage. That runtime path only exists if the directory is
in the image, and the Dockerfile never copied it — so both routes 404 on alpha
while working perfectly from a dev checkout.

Caught by deploying 1.9.29-rc1 to alpha, which is the whole point of alpha.

Worth noting how this fails when the route is absent entirely, as on prod today:
the SPA fallback answers 200 with text/html, so the browser gets a page where it
expected JavaScript, window.ScreenTinkerBS is never defined, and the player
silently falls back to browser behaviour. A missing asset that returns 200 is
considerably harder to notice than one that 404s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uaeo9MvzKoyXuN6ZsbhtkL

Dockerfile

@@ -39,6 +39,12 @@ COPY VERSION /app/VERSION
 COPY docs/openapi.yaml /app/docs/openapi.yaml
 # database.js requires scripts/migrate-multitenancy at boot
 COPY scripts/ /app/scripts/
+# The BrightSign bridge and sync modules are served to the player from ../brightsign so the copy
+# the player loads can never drift from the one on the player's own storage. That RUNTIME path
+# does not exist unless the directory is in the image: without this the routes 404 in a container
+# while working perfectly from a dev checkout — and a missing player asset fails silently, because
+# the SPA fallback answers 200 with HTML where JavaScript was expected.
+COPY brightsign/ /app/brightsign/
 VOLUME ["/data"]
 EXPOSE 3001
 CMD ["node", "server.js"]