feat(books): add read-aloud generation

Generate a synced read-aloud EPUB from a book's EPUB and audiobook through an
optional STAlign worker (Docker on CPU, or native with MLX on Apple Silicon),
with review, re-sync, replace in place, restart recovery and live progress on
the Files tab. Book details also stack the ebook and audiobook covers when
both exist. See docs/READ_ALOUD.md.

.github/actions/setup-node-pnpm/action.yml

@@ -63,7 +63,11 @@ runs:
       shell: bash
       run: pnpm fetch --frozen-lockfile
 
+    # onnxruntime-node's postinstall otherwise downloads its CUDA provider on Linux x64. Nothing in CI
+    # uses it, and the CPU binding the read-aloud worker tests load ships in the npm package itself.
     - name: Install dependencies
       if: ${{ inputs.install == 'true' }}
       shell: bash
+      env:
+        ONNXRUNTIME_NODE_INSTALL: skip
       run: pnpm install --frozen-lockfile

.github/workflows/ci.yml

@@ -261,6 +261,7 @@ jobs:
           filters: |
             server:
               - 'server/**'
+              - 'workers/**'
               # Server tests assert against the plugin sources, so plugin-only
               # changes can break them.
               - 'koreader-plugin/**'
@@ -414,6 +415,7 @@ jobs:
         run: |
           if [[ "$PACKAGE" == "server" ]]; then
             pnpm --filter server type-check
+            pnpm --filter @bookorbit/read-aloud-worker type-check
           else
             pnpm --filter @bookorbit/types build
             pnpm --filter client type-check
@@ -488,6 +490,15 @@ jobs:
             pnpm --filter client exec vitest --run --coverage --reporter=default --reporter=junit --outputFile="$JUNIT_OUTPUT"
           fi
 
+      # The worker's control process, runner and resume logic run against a fake pipeline; the real
+      # STAlign smoke run stays opt-in (READ_ALOUD_SMOKE=1).
+      - name: Run read-aloud worker tests
+        if: steps.has-changes.outputs.run == 'true' && matrix.package == 'server'
+        shell: bash
+        run: |
+          pnpm --filter @bookorbit/types build
+          pnpm --filter @bookorbit/read-aloud-worker test
+
       - name: Upload coverage reports to Codecov
         if: steps.has-changes.outputs.run == 'true' && env.CODECOV_TOKEN != ''
         uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
@@ -684,6 +695,28 @@ jobs:
           ignore-unfixed: true
           exit-code: "1"
 
+      - name: Build read-aloud worker image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: ./workers/read-aloud/Dockerfile
+          push: false
+          load: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-read-aloud-worker:${{ steps.pr-meta.outputs.scan_tag }}
+          platforms: linux/amd64
+          cache-from: type=gha,scope=ci-yml-pr-read-aloud-worker
+          cache-to: type=gha,mode=max,scope=ci-yml-pr-read-aloud-worker
+
+      - name: Scan read-aloud worker image with Trivy
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-read-aloud-worker:${{ steps.pr-meta.outputs.scan_tag }}
+          format: table
+          vuln-type: os,library
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: "1"
+
   pr-image-publish:
     name: PR Image Publish
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -355,6 +355,21 @@ jobs:
             type=gha,scope=container-image-yml-amd64
             type=gha,scope=container-image-yml-arm64
 
+      - name: Build and push read-aloud worker image
+        id: build-read-aloud-worker
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: ./workers/read-aloud/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-read-aloud-worker:${{ needs.release.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-read-aloud-worker:latest
+          build-args: APP_VERSION=v${{ needs.release.outputs.version }}
+          cache-from: type=gha,scope=release-read-aloud-worker
+          cache-to: type=gha,mode=max,scope=release-read-aloud-worker
+
       - name: Enrich release notes
         shell: bash
         env:
@@ -407,3 +422,4 @@ jobs:
           echo "- **Version:** \`${VERSION}\`" >> "$GITHUB_STEP_SUMMARY"
           echo "- **Tags:** \`${VERSION}\`, \`latest\` (linux/amd64, linux/arm64)" >> "$GITHUB_STEP_SUMMARY"
           echo "- **APP_VERSION baked:** \`v${VERSION}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **Read-aloud worker:** \`${VERSION}\`, \`latest\` (linux/amd64, linux/arm64)" >> "$GITHUB_STEP_SUMMARY"