Run the tests on Node 22.16, and fix what a fresh setup tripped over

Node 22.16 runs TypeScript only behind --experimental-strip-types (on by
default from 22.18), so `npm test` failed on every file with
ERR_UNKNOWN_FILE_EXTENSION. The flag is harmless on newer versions.

probe and session-diagnose still imported dist/schulcloud/client.js, which
the move to core/ renamed, so both scripts died at import.

A relative MIRROR_DIR broke file serving: res.sendFile refuses a relative
path, and resolveWithin returns an absolute path only when its root is one.
The config resolves it once, at load.

package-lock.json is what `npm install` records today: the `schulcloud`
bin, and no stale peer flags. 101 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/config.ts

@@ -6,6 +6,8 @@
  * DevTools stays an obvious, mechanical step — see docs/AUTH.md.
  */
 
+import { resolve } from 'node:path';
+
 export interface Config {
 	/** Instance base URL, no trailing slash, e.g. `https://schulcloud-thueringen.de`. */
 	baseUrl: string;
@@ -76,7 +78,9 @@ export function loadConfig(): Config {
 		requestTimeoutMs: int('REQUEST_TIMEOUT_MS', 30_000),
 		keepaliveIntervalMs: intAllowingZero('KEEPALIVE_INTERVAL_MS', 30 * 60_000),
 		databaseUrl: process.env.DATABASE_URL?.trim() || undefined,
-		mirrorDir: process.env.MIRROR_DIR?.trim() || '/var/lib/schulcloud-mcp/mirror',
+		// Absolute: res.sendFile rejects a relative path, and resolveWithin only
+		// returns an absolute path if the root it is given is one.
+		mirrorDir: resolve(process.env.MIRROR_DIR?.trim() || '/var/lib/schulcloud-mcp/mirror'),
 		mirrorMaxBytes: int('MIRROR_MAX_BYTES', 64 * 1024 * 1024),
 		crawlIntervalMs: intAllowingZero('CRAWL_INTERVAL_MS', 6 * 60 * 60_000),
 	};