Drop copyfiles, bump swagger-jsdoc's glob — silence install warnings

[mitchallen]

npm ci printed three npm deprecation warnings on every install and in every CI run, none indicating a real problem:

inflight@1.0.6   <- copyfiles -> glob@7
glob@7.2.3       <- copyfiles
glob@11.1.0      <- swagger-jsdoc

Warnings that always appear and never matter train you to ignore install output, so a genuine one gets scrolled past.

Changes

copyfiles removed. It's unmaintained and was doing a job Node does natively. scripts/copy-yaml.mjs is a dependency-free fs.cpSync with a *.yaml filter, replacing copyfiles -u 1 "src/**/*.yaml" dist. This kills two of the three warnings, drops a devDependency, and lets the nested copyfiles → minimatch → brace-expansion override go with it.

swagger-jsdoc's glob overridden to ^13.0.6. Safe here for two specific reasons: glob v13 still exports the .sync that swagger-jsdoc calls, and the apis entries are literal file paths rather than patterns, so v9+ result-ordering changes cannot apply.

Verification

Check	Result
Cold npm ci deprecation warnings	0 (was 3)
Generated swagger spec	Byte-identical — sha1 a5feae69 before and after
dist/*.yaml layout	Unchanged (3 files, same paths)
Cucumber suite	11 scenarios, 60 steps ✅
npm audit	0 vulnerabilities
Fresh clone → npm ci && build && test	✅ passes

The spec comparison is the important one for the glob override — it's captured from the running server's /api-docs, so it exercises swagger-jsdoc's actual glob call path.

One gap

The Docker build is unverified — the daemon wasn't running locally. scripts/ is picked up by the Dockerfile's COPY . . and isn't in .dockerignore, and the fresh-clone build proves the script is committed and works, but note that PR CI doesn't build the image — only the tag-triggered publish workflows do. Worth a local docker build before the next release tag.

🤖 Generated with Claude Code

[mitchallen]

Docker build verified locally (daemon was down when this PR was opened):

• docker build succeeds on this branch
• scripts/copy-yaml.mjs runs correctly inside the builder stage — all three yaml files land at the right paths in the image (/app/dist/root.yaml, /app/dist/controllers/random-{coord,person}.yaml)
• container serves /, /v1/people/1, and /api-docs normally; swagger spec is 16106 bytes, matching the pre-change baseline exactly