fix: include Smee client in production image

[zeyu2001]

Summary

• include smee-client in production dependencies
• keep the lockfile's production dependency metadata in sync

Root cause

The Dockerfile sets NODE_ENV=production before running npm ci. Because smee-client was listed under devDependencies, npm omitted it from the deployed image. Probot therefore started the HTTP server but warned that the Smee client was unavailable and never connected to the configured webhook proxy.

GitHub App delivery history confirmed that pull_request events received HTTP 200 from the configured Smee channel, while a no-diff smoke PR produced no Safe-setting validator check in the app and the pod had no established Smee connection.

Validation

• npm run test:unit:ci — 16 suites passed, 137 tests passed, 14 skipped
• npm run lint:lockfile — passed
• npm ls smee-client --omit=dev — resolves smee-client@5.0.0
• production Docker image build — passed
• require.resolve('smee-client') inside the production image — /opt/safe-settings/node_modules/smee-client/index.js
• git diff --check — passed

The repository-wide JavaScript lint still reports pre-existing violations in unchanged source and test files.

Post-merge proof

After auto-deployment, open a fresh no-diff pull request and verify that the GitHub App creates and completes the Safe-setting validator check, then remove the temporary PR and branch.

---

Note

Low Risk
Dependency classification and lockfile metadata only; no application logic changes, but it affects how production containers receive GitHub webhooks via Smee.

Overview
Moves smee-client from devDependencies to dependencies in package.json, with matching package-lock.json updates so production installs include it and its runtime deps (eventsource, etc.) are no longer marked dev-only.

This fixes deployed images built with npm ci under production/NODE_ENV=production, where the Smee webhook proxy client was previously omitted and Probot could not connect to the configured Smee channel despite returning HTTP 200 for deliveries.

^{Reviewed by Cursor Bugbot for commit 4b0f43f. Bugbot is set up for automated code reviews on this repo. Configure here.}