Add Gitea Actions CI/CD pipeline

Build and push images to the private registry, then deploy to the VPS by commit SHA with health check and rollback.

deploy/rollback.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Re-deploys the last tag that passed a health check, or an explicit tag:
+#
+#   /home/deploy/websites/ksan.dev/rollback.sh            # last known good
+#   /home/deploy/websites/ksan.dev/rollback.sh <sha>      # a specific build
+#
+# The image is already on the host, so this is a container restart, not a build.
+set -euo pipefail
+
+SITE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SITE_DIR"
+
+if [[ $# -ge 1 ]]; then
+  IMAGE_TAG="$1"
+elif [[ -f .tag.good ]]; then
+  IMAGE_TAG="$(cat .tag.good)"
+else
+  echo "rollback: no .tag.good and no tag given — nothing to roll back to" >&2
+  exit 1
+fi
+
+if [[ ! "$IMAGE_TAG" =~ ^[0-9a-f]{7,40}$ ]]; then
+  echo "rollback: invalid tag '$IMAGE_TAG'" >&2
+  exit 1
+fi
+export IMAGE_TAG
+
+echo "rollback: restoring $IMAGE_TAG"
+docker compose pull --quiet
+docker compose up -d --remove-orphans --wait --wait-timeout 120
+echo "rollback: $IMAGE_TAG is live"