Feat v0.3.8 distribution (#21)

Bundled packages auto-install on first boot for zero-config first run.
Builder image for faster custom builds. Per-environment allowlists for
K8s/Helm (dev=all, test=all, prod=skip).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/config/config.go

@@ -63,6 +63,15 @@ type Config struct {
 	MTLSAutoActivate      bool   // auto-activate new users (default true)
 	MTLSDefaultTeam       string // team ID for auto-provisioned users (optional)
 
+	// Bundled packages (v0.3.8)
+	// SKIP_BUNDLED_PACKAGES: set true to disable auto-install of bundled packages on first run.
+	// BUNDLED_PACKAGES_DIR: directory containing pre-built .pkg archives (default /app/bundled-packages).
+	// BUNDLED_PACKAGES: comma-separated allowlist of package IDs to install (empty = all).
+	//   e.g. "tasks,schedules,hello-dashboard" installs only those three.
+	SkipBundledPackages bool
+	BundledPackagesDir  string
+	BundledPackages     string
+
 	// OIDC (v0.24.1)
 	OIDCIssuerURL    string // e.g. "https://keycloak.corp/realms/switchboard"
 	OIDCExternalIssuerURL string  // OIDC_EXTERNAL_ISSUER_URL
@@ -105,6 +114,10 @@ func Load() *Config {
 		S3Prefix:              getEnv("S3_PREFIX", ""),
 		S3ForcePathStyle:      getEnv("S3_FORCE_PATH_STYLE", "true") == "true",
 
+		SkipBundledPackages: getEnvBool("SKIP_BUNDLED_PACKAGES", false),
+		BundledPackagesDir:  getEnv("BUNDLED_PACKAGES_DIR", "/app/bundled-packages"),
+		BundledPackages:     getEnv("BUNDLED_PACKAGES", ""),
+
 		LogFormat: getEnv("LOG_FORMAT", "text"),
 		LogLevel:  getEnv("LOG_LEVEL", "info"),