Ship Next.js standalone backend bundle (6MB xz) for userspace Node runtime

node_runtime.py now extracts backend-bundle/respite-backend.tar.xz before
launching server.js. Provider keys set as Space secrets via Hub API.

backend-bundle/respite-backend.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:71ec3b6e07d58ca02886cd78a53d7e93d34a81069246ea17bb988e0b6c2edfec
+size 6204324

node_runtime.py

@@ -71,14 +71,29 @@ def _wait_ready(proc: subprocess.Popen, timeout: float = 90.0) -> bool:
     return False
 
 
+def _ensure_backend_extracted() -> bool:
+    """Extract backend-bundle/respite-backend.tar.xz if the backend dir is absent."""
+    if os.path.isdir(BACKEND_DIR) and os.path.exists(os.path.join(BACKEND_DIR, "server.js")):
+        return True
+    bundle = os.path.join(os.path.dirname(os.path.abspath(__file__)), "backend-bundle", "respite-backend.tar.xz")
+    if not os.path.exists(bundle):
+        _log(f"no bundle at {bundle}")
+        return False
+    _log(f"extracting {bundle} -> {BACKEND_DIR}")
+    os.makedirs(BACKEND_DIR, exist_ok=True)
+    with tarfile.open(bundle, "r:xz") as tf:
+        tf.extractall(BACKEND_DIR)
+    _log("backend extracted")
+    return True
+
+
 def start_node_backend() -> bool:
     """Launch the Next.js standalone server. Safe to call once at startup."""
     global _node_proc
     if os.environ.get("NODE_PROXY_OFF") == "1":
         _log("disabled via NODE_PROXY_OFF")
         return False
-    if not os.path.isdir(BACKEND_DIR):
-        _log(f"backend dir missing: {BACKEND_DIR}")
+    if not _ensure_backend_extracted():
         return False
     with _node_lock:
         if _node_proc and _node_proc.poll() is None: