Modernize: interactive-messages -> Bolt, Sentry 10, TS/CI + GHCR/Coolify deploy

[ddbruce]

Summary

Replaces Slack's deprecated @slack/interactive-messages adapter with @slack/bolt, and modernizes the rest of the stack. The /inorout poll behavior is preserved: inline + modal poll creation, voting, anonymous/multiple modes, and the reset/lock/move/delete options with author-only ephemeral guards. The vote/tally core (Poll.ts) is unchanged and is now unit-tested.

Verified: tsc compiles, 8 unit tests pass (vote tally, reset, single-vs-multiple, anonymous, author parsing), boots on Bolt 4 with /health → 200 and unsigned /slack/events → 401; amd64 image builds with 0 npm vulnerabilities.

⚠️ This is the migration I could not exercise against live Slack. Structural behavior is verified, but please smoke-test a real poll in staging (see "Verify in staging" below) before production.

Changes

• SDK/routing: removed @slack/interactive-messages + express + body-parser; added @slack/bolt 4.x. @slack/web-api 6→7, dotenv 10→17. Vote buttons got stable action_ids (vote_<n>) and the options select got poll_options so Bolt can route them (Bolt matches by action_id, not element type); the modal view got callback_id: "poll_modal".
• Sentry: 6 → 10; replaced the removed configureScope() with setUser()/setExtra().
• TypeScript: target es5 → ES2022 (kept commonjs); ESLint (the broken 10.x + legacy .eslintrc) → ESLint 9 flat config with typescript-eslint 8; ts-jest tests added.
• Container/CI: multi-stage Dockerfile (build tsc, ship out/ + prod deps only), node:24-alpine, non-root, HEALTHCHECK; dead Drone CI → GitHub Actions (lint + compile + test + amd64 build); scripts/deploy.sh + config.example.sh.

⚠️ Required Slack app config change

Bolt serves one endpoint. Point both of these at the same URL:

• Slash Commands → Request URL: https://<host>/slack/events
• Interactivity & Shortcuts → Request URL: https://<host>/slack/events

(Previously they were split: /slack/commands and /slack/actions.) No app re-creation needed. Env vars are unchanged (SLACK_ACCESS_TOKEN, SLACK_SIGNING_SECRET, PORT, SENTRY_DSN, ENVIRONMENT).

Verify in staging (behavior deltas)

1. Create a poll both ways: /inorout (modal) and /inorout with option lines.
2. Vote / change vote; try an anonymous and a multiple poll.
3. Options select: reset, lock, move to bottom, delete (as author and as non-author).
4. Note these intentional deltas from the old adapter:
   • The transient "Vote processing!" / "Processing request!" flash messages are gone (they were slowness workarounds; ack + message update is immediate now).
   • On a processing error, the user now gets an ephemeral error instead of the error text replacing the poll.
   • Existing in-flight polls posted before deploy (whose buttons have no action_id) won't route to the new handlers — recreate any active polls after deploying.

Recommended follow-ups (NOT done)

• ModalMap is still an in-memory Map (open modals are lost on restart / not multi-instance safe).
• Poll state is still encoded in the message and recovered by substring-matching the title — brittle but unchanged.