Add Gitea Actions CI/CD pipeline

Build and push images to the private registry, then deploy to the VPS by commit SHA with health check and rollback.

deploy/deploy.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Runs on the deploy VPS as the `deploy` user (member of the docker group).
+# Shipped here by CI alongside docker-compose.yaml.
+#
+#   IMAGE_TAG=<sha> /home/deploy/websites/ksan.dev/deploy.sh
+#
+# On success the tag is recorded in .tag.good, which rollback.sh reads.
+set -euo pipefail
+
+SITE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SITE_DIR"
+
+: "${IMAGE_TAG:?IMAGE_TAG must be set}"
+if [[ ! "$IMAGE_TAG" =~ ^[0-9a-f]{7,40}$ ]]; then
+  echo "deploy: refusing to deploy non-sha tag '$IMAGE_TAG'" >&2
+  exit 1
+fi
+export IMAGE_TAG
+
+echo "deploy: pulling $IMAGE_TAG"
+docker compose pull --quiet
+
+echo "deploy: starting"
+# --wait blocks on the healthcheck, so a container that boots and immediately
+# dies fails here rather than being reported as a successful deploy.
+if ! docker compose up -d --remove-orphans --wait --wait-timeout 120; then
+  echo "deploy: container did not become healthy" >&2
+  docker compose logs --tail 50 >&2 || true
+  exit 1
+fi
+
+echo "$IMAGE_TAG" > .tag.good
+echo "deploy: $IMAGE_TAG is live"
+
+# Old images accumulate fast on a multi-site box; keep a week for rollbacks.
+docker image prune -f --filter until=168h >/dev/null 2>&1 || true