chore: target latest-stable everywhere — Debian Trixie + gtk4 v4_14

- CI workflow container: debian:trixie-slim (was bookworm-slim)
- Server image base: node:23-trixie-slim (was bookworm-slim)
- Kiosk Cargo.toml: gtk4 features v4_14 (was v4_8) — matches Trixie's
  stock gtk 4.14 without backports juggling
- setup-pi-kiosk.sh header: Trixie+ target (was Bookworm+)

Glibc matches across Pi OS Trixie, Coolify host (Trixie), CI build
container — no symbol drift at runtime.

.github/workflows/release-kiosk.yml

@@ -2,10 +2,10 @@
 # each as a GitHub Release asset, and optionally auto-import into a running
 # BetterFrame server via /api/admin/firmware/import.
 #
-# Build environment is debian:bookworm-slim (matches Raspberry Pi OS Bookworm
+# Build environment is debian:trixie-slim (matches Raspberry Pi OS Trixie
-# the kiosk deploys to). Building on Ubuntu would link against a newer glibc
+# the kiosk deploys to). Trixie ships gtk4 4.14 + libwebkitgtk-6.0 natively,
-# than the Pi ships → `GLIBC_2.38 not found` at runtime. Runner host distro
+# no backports needed. glibc matches Pi OS Trixie → no runtime symbol drift.
-# doesn't matter; we run all steps inside the bookworm container.
+# Runner host distro doesn't matter; everything runs inside the container.
 #
 # Required secrets:
 #   BF_AUTOIMPORT_URL       e.g. https://bf.example.com  (optional)
@@ -43,10 +43,10 @@ jobs:
 
     runs-on: ${{ matrix.runs-on }}
 
-    # Lock glibc + APT package set to Bookworm — matches RPi OS Bookworm
+    # Lock glibc + APT package set to Trixie — matches RPi OS Trixie
-    # (Debian 12) which kiosks run. Raspbian is Debian; same packages.
+    # (Debian 13) which kiosks run. Raspbian is Debian; same packages.
     container:
-      image: debian:bookworm-slim
+      image: debian:trixie-slim
 
     steps:
       - name: Bootstrap apt + git (container has none preinstalled)
@@ -78,8 +78,7 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
       - name: Install GTK/GStreamer/WebKit build deps
-        # gtk4-rs 0.9 with the v4_8 feature builds against bookworm's stock
+        # Trixie stock: gtk4 4.14 + libwebkitgtk-6.0 — no backports needed.
-        # libgtk-4-dev 4.8.3 — same version that ships on Pi OS Bookworm.
         run: |
           apt-get install -y --no-install-recommends \
             libgtk-4-dev libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev \

deploy/docker/Dockerfile.server

@@ -1,5 +1,7 @@
-# BetterFrame server image — Node 23 + native deps for argon2/sqlite
+# BetterFrame server image — Node 23 + native deps for argon2/sqlite.
-FROM node:23-bookworm-slim AS builder
+# Trixie base (Debian 13, latest stable) — matches the host distro we
+# recommend in deploy/README.md.
+FROM node:23-trixie-slim AS builder
 
 WORKDIR /app
 
@@ -20,7 +22,7 @@ WORKDIR /app/server
 RUN npm run build
 
 # ---- Runtime image ----
-FROM node:23-bookworm-slim
+FROM node:23-trixie-slim
 
 # ffmpeg for camera snapshot capture (optional but needed for /admin/entities/:id/snapshot)
 RUN apt-get update && apt-get install -y --no-install-recommends \

deploy/scripts/setup-pi-kiosk.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Single-host BetterFrame installer/updater for Raspberry Pi 5 (Bookworm+).
+# Single-host BetterFrame installer/updater for Raspberry Pi 5 (Trixie+).
 #
 # What it does (every step idempotent — safe to re-run for updates):
 #   1. clone or `git pull` the BetterFrame repo into the invoking user's home
@@ -260,7 +260,7 @@ EOF
     -o "${THEME_DIR}/logo.png"
   plymouth-set-default-theme -R betterframe
 
-  # Find the boot config / cmdline file. Bookworm uses /boot/firmware/, older
+  # Find the boot config / cmdline file. Bookworm/Trixie use /boot/firmware/, older
   # Pi images use /boot/.
   if [ -f /boot/firmware/cmdline.txt ]; then
     BOOT_DIR=/boot/firmware

kiosk/Cargo.toml

@@ -6,10 +6,9 @@ description = "BetterFrame kiosk — multi-camera display with GTK4 + GStreamer"
 license = "AGPL-3.0-only OR Commercial"
 
 [dependencies]
-# GTK4 for windowing/layout. v4_8 = Pi OS Bookworm's libgtk-4 version. We
+# GTK4 for windowing/layout. v4_14 = Debian Trixie / Pi OS Trixie stock
-# don't use any 4.12+ APIs; bumping the feature gate would force pulling
+# libgtk-4-dev — keeps us on latest-stable without backports.
-# from backports for no functional gain.
+gtk4 = { version = "0.9", features = ["v4_14"] }
-gtk4 = { version = "0.9", features = ["v4_8"] }
 
 # GStreamer for RTSP decode
 gstreamer = "0.23"