Make lint and test phases of the Dockerfile (closes #96)

Follows the template: Dockerfile.lint is gone; the Dockerfile has a lint
phase (eslint, prettier --check .) and a test phase (vitest, run as the
node user, which the not-writable-directory tests need), and its
last stage compiles and depends on both. script/lint and script/test
build one phase each with --no-cache; script/docker and script/cibuild
pass --no-cache, so CHECK_EPOCH and LINT_EPOCH are removed.
script/cibuild is the single image build, so CI runs lint and the tests
once each. The tests that checked the old layout are deleted,
REPO_POLICIES.md is re-copied and the README describes the new layout.

Model: opus-5-5

test/crypto/kdf.test.ts

@@ -29,10 +29,10 @@ describe("crypto.deriveKEK (Argon2id)", () => {
     });
 
     /**
-     * Cheap parameters used so the test suite stays under the 30-second
-     * budget. The real production parameters Ente uses are larger
-     * (memLimit up to 1 GiB, opsLimit 3-16). The algorithm is the same
-     * regardless of parameters.
+     * Cheap parameters used so the test suite stays under the 90-second
+     * `timeout` in the `test` phase of the `Dockerfile`. The real production
+     * parameters Ente uses are larger (memLimit up to 1 GiB, opsLimit 3-16).
+     * The algorithm is the same regardless of parameters.
      */
     const TEST_OPS = 2;
     const TEST_MEM = 64 * 1024 * 1024; // 64 MiB