Node 24, and stop pointing at the mobile app that left the repository (#53)

mobile/ was moved out in April (18d41743), but the root package.json still
ran it: `npm run build`, `lint`, `test` and `dev` all called into a missing
directory and failed. The scripts now cover what is here (web, sign,
backend), concurrently is gone with the only command that needed it, and the
root lockfile shrinks to nothing.

The README described the mobile app and not the signing portal; it now lists
the real layout (web, sign, backend, shared, ops).

Node 20 is past its end of life. CI and both images move to Node 24; the
backend's sqlite3 native module builds and its tests pass on 24.

backend/Dockerfile

@@ -9,14 +9,14 @@
 # replaces the container/image but never the volume — see backend/DEPLOY.md.
 
 # ─── Stage 1: install production deps (compiles sqlite3) ────────
-FROM node:20-bookworm AS builder
+FROM node:24-bookworm AS builder
 WORKDIR /app
 COPY package.json package-lock.json ./
 # --omit=dev: the test-only devDeps (supertest, @pezkuwi/keyring) never ship.
 RUN npm ci --omit=dev
 
 # ─── Stage 2: runtime ──────────────────────────────────────────
-FROM node:20-bookworm-slim
+FROM node:24-bookworm-slim
 ENV NODE_ENV=production
 ENV PORT=3001
 # DB on the volume, never in the image layer.