docs: source-build prerequisites omit Node.js and libsqlite3-dev

[exactmike]

Summary

Building from source on a clean Linux box fails twice with the documented
prerequisites installed. The docs list Go, Bun, and a C/C++ compiler, but
make install also requires Node.js and libsqlite3-dev. Both are
installed by CI and the Dockerfile, so the gap is invisible in automation and
only shows up on a developer's own machine.

I hit both on a fresh Ubuntu install and thought they were worth reporting
together, since a first-time contributor hits them back-to-back.

Reproduction

Fresh Ubuntu 26.04, following docs/setup.md → Build From
Source exactly:
Go 1.26.6 (matching the go.mod directive), Bun 1.3.14 (matching
web/package.json's packageManager), and build-essential.

git clone https://github.com/kenn-io/msgvault.git
cd msgvault
make install

Failure 1 — missing Node. The whole Bun pipeline succeeds (bun install,
bun run generate, vite build all fine), then:

node scripts/check-web-assets.mjs
make: node: No such file or directory
make: *** [Makefile:259: web-embed] Error 127

Failure 2 — missing sqlite3.h. After installing Node, the Go build reaches
the cgo step and dies:

# github.com/asg017/sqlite-vec-go-bindings/cgo
In file included from .../sqlite-vec-go-bindings@v0.1.6/cgo/lib.go:5:
./sqlite-vec.h:7:10: fatal error: sqlite3.h: No such file or directory
    7 | #include "sqlite3.h"
      |          ^~~~~~~~~~~
compilation terminated.
make: *** [Makefile:70: install] Error 1

Fixed by sudo apt install -y libsqlite3-dev.

Why CI and Docker don't catch either

• Node: no workflow runs actions/setup-node — GitHub-hosted runners ship
  Node preinstalled, so node is always on PATH in CI.

• libsqlite3-dev: ci.yml:34
  installs it in the build-tools step, and
  Dockerfile:25
  installs it with a comment that names the exact reason:

  libsqlite3-dev provides sqlite3.h, required to compile the sqlite-vec extension (asg017/sqlite-vec-go-bindings) under -tags sqlite_vec

  Since BUILD_TAGS := fts5 sqlite_vec (Makefile:18) is the default for every
  build, this is required for the documented build, not an opt-in extra.

So the knowledge exists in the repo — it just never reached the user-facing
docs.

Where the docs say it

Three places carry the same incomplete list:

File	Line	Text
README.md	76-77	"requires Go 1.26+, Bun 1.3.14+, and a C/C++ compiler for CGO and to statically link DuckDB"
docs/setup.md	48	"Requires Go 1.26+, Bun 1.3.14+, and a C/C++ compiler (GCC or Clang)."
docs/development.md	8	"Source builds require Go 1.26+, Bun 1.3.14+, and a C/C++ compiler."

One thing that actively compounds the Node confusion: the only mention of Node
in the README is README.md:107, saying Node is not needed —

"The same release binary serves the complete browser application; Node, Bun,
and a separate asset directory are not needed at runtime."

That's correct about runtime, but a reader can reasonably generalize it to
"Node isn't needed at all," which is the opposite of the build-time truth.

Suggested fix

Amend the prerequisite sentence in all three places to something like:

Requires Go 1.26+, Bun 1.3.14+, Node.js 20+, and a C/C++ compiler (GCC or
Clang). On Debian/Ubuntu also install libsqlite3-dev, which provides the
sqlite3.h header needed to compile the sqlite_vec extension in the default
build.

And optionally add the sqlite3.h failure to the existing CGO / Build Errors
section in docs/troubleshooting.md (~line 213), which already covers the
missing-compiler case but not this one.

I'm happy to open a PR for the docs change if that's useful — just say which
wording you prefer.

Optional: the Node requirement looks removable

Node is pulled into the default build path by exactly one line
(Makefile:259):

web-embed: web-build
	...
	node scripts/check-web-assets.mjs

Bun is already a hard requirement, and it runs that script correctly. I checked
both on the same staged tree:

$ bun  scripts/check-web-assets.mjs   → validated 8 release web assets   (exit 0)
$ node scripts/check-web-assets.mjs   → validated 8 release web assets   (exit 0)

So changing that one word would drop Node from the default build entirely and
make the current docs accurate as written. Two caveats:

1. web-assets-check and smoke-web-release use node --test, whose Bun
   equivalent is not a drop-in. Those aren't in the build/install path, so
   they could keep using Node — but it does mean Node stays a requirement for
   the full test suite, and that's worth documenting either way.
2. If running the validator under Node is a deliberate choice (validating the
   embed under the same runtime as the --test harness), then ignore this and
   just document Node — the docs fix above is the real ask.

Environment

• Ubuntu 26.04 LTS (WSL2), x86_64
• Go 1.26.6, Bun 1.3.14, Node 24.19.0, GCC 15.2.0, GNU Make 4.4.1
• msgvault 3806380

[salmonumbrella]

@exactmike feel free to submit a PR.