fix(hub): enable tenant Typst package resolution

hub/deploy/deploy_fleet_release.sh

@@ -85,7 +85,7 @@ REMOTE
     -e "ssh ${SSH_OPTS[*]}" \
     "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-  echo "[fleet] npm ci + build (tsc + admin-web SPA)"
+  echo "[fleet] npm ci (including build-time dev deps) + build (tsc + admin-web SPA)"
   ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
 set -euo pipefail
 flock /var/lock/cph-hub-release-publish bash -c '
@@ -95,8 +95,10 @@ flock /var/lock/cph-hub-release-publish bash -c '
     exit 0
   fi
   cd "$HUB_DIR"
-  PUPPETEER_SKIP_DOWNLOAD=1 npm ci
-  npm ci --prefix admin-web
+  PUPPETEER_SKIP_DOWNLOAD=1 npm ci --include=dev
+  npm ci --include=dev --prefix admin-web
+  test -x node_modules/.bin/tsc
+  test -x admin-web/node_modules/.bin/vite
   npm run audit:production
   npm run build
   test -f admin-web/build/index.html

hub/deploy/deploy_platform.sh

@@ -60,10 +60,12 @@ if [ "$release_ready" = false ]; then
     -e "ssh ${SSH_OPTS[*]}" \
     "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-  # 2. Install deps (hub + admin-web), audit hub prod, build tsc + SPA, mark complete.
+  # 2. Install deps (including build-time dev deps) for hub + admin-web,
+  # audit hub prod, build tsc + SPA, mark complete. NODE_ENV=production may be
+  # inherited by the remote shell, so --include=dev is intentional here.
   # `npm run build` → tsc then admin:build → admin-web/build for registerStaticSpa.
   ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
-    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci && npm ci --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
+    "cd '$HUB_DIR' && PUPPETEER_SKIP_DOWNLOAD=1 npm ci --include=dev && npm ci --include=dev --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
 fi
 
 # 3. Ensure the service is installed (idempotent), then restart.