Modernize: Bolt 4, async/error handling, Node 24 + GHCR/Coolify deploy

[ddbruce]

Summary

Behavior-preserving modernization of at-channel. Same /channel workflow: blank-request guard, moderated-channel approval flow (mod message + requester ephemeral + cancel DM), non-moderated immediate post, the approve / approve-without-@channel / reject / cancel button actions, and moderator permission checks (including "can't approve your own request"). All Block Kit message content is byte-for-byte unchanged. Verified: 6 unit tests pass; boots on Bolt 4 with /health → 200 and unsigned /slack/events → 401; amd64 image builds with 0 npm vulnerabilities.

Changes

• SDK/runtime: @slack/bolt 1.2 → 4.4 — this is the substantive change. Rewrote the command/action middleware chains for v4: await ack() and await next() (were unawaited, which v4 requires). Custom HTTPReceiver adds GET /health; /slack/events and signing-secret verification are unchanged, so no Slack app config change. dotenv 8→17, emoji-regex 8→10, md5 2.2→2.3; Dockerfile node:latest → pinned node:24-alpine, npm ci, non-root, HEALTHCHECK; moved ESLint out of runtime deps; nodemon 1→3.
• Robustness: awaited the previously fire-and-forget Slack calls up the handler chain so failures go through app.error instead of crashing (same messages, deterministic order). Fixed the unreachable randomEmoji default branch (concat results were discarded) — not hit by current callers, so no behavior change.
• Testability: extracted the duplicated channel/user-ID regex parsing into utilities/parse.js (identical regex) and randomEmoji into utilities/emoji.js; added Jest tests.
• Tooling/CI: ESLint 6 (EOL) → 9 flat config matching the repo's original rule set (this repo never had a lint script, so two pre-existing >90-char user-facing strings carry a targeted max-len disable to stay byte-identical); dead Drone CI → GitHub Actions.
• Deploy: scripts/deploy.sh + config.example.sh; secrets in gitignored scripts/config.sh.

Env notes (docs only, no new required vars)

• .env.example now documents SLACK_USER_TOKEN (the code always used it for usergroup lookups; it was missing from the example).
• Corrected PORT → NODE_PORT in .env.example (the code reads NODE_PORT; the old PORT entry was never read).

Recommended follow-ups (NOT done — would change behavior)

• IDs are still recovered by regex-parsing rendered block text (fragile if layout changes); the sturdier fix is to carry channel_id/user_id in button values. Left as-is to preserve exact behavior.
• Moderated channels are still a hardcoded switch on names (general/alerts/random/scheduling), and sendForApproval still posts to the literal channel name "at-channel-requests" rather than MOD_CHANNEL_ID. Both preserved verbatim; worth making config-driven later.
• Minor user-facing typos ("requsted", "messasge") left untouched to avoid changing output.