Add Gitea Actions CI/CD pipeline

Build and push images to the private registry, then deploy to the VPS by commit SHA with health check and rollback.

docker-compose.yaml

@@ -0,0 +1,39 @@
+services:
+  ksan-dev:
+    # Built and pushed by CI; deployed by tag, never by :latest, so a rollback
+    # is a re-run of `up -d` with an older tag instead of a rebuild.
+    image: ${IMAGE_NAME:-git.ksan.dev/ksan/ksan.dev}:${IMAGE_TAG:-latest}
+    container_name: ksan-dev
+    restart: unless-stopped
+    env_file:
+      - .env
+    networks:
+      - frontend
+    # Shared VPS: keep one site's leak from taking the box down with it.
+    mem_limit: 512m
+    cpus: 0.5
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    # `/` 307-redirects to the default locale, so probe the locale path directly.
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/en"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.ksan-dev-http.rule=Host(`${DOMAIN}`) || Host(`www.${DOMAIN}`)
+      - traefik.http.routers.ksan-dev-http.entrypoints=web
+      - traefik.http.routers.ksan-dev-https.tls=true
+      - traefik.http.routers.ksan-dev-https.tls.certresolver=cloudflare
+      - traefik.http.routers.ksan-dev-https.entrypoints=websecure
+      - traefik.http.routers.ksan-dev-https.rule=Host(`${DOMAIN}`) || Host(`www.${DOMAIN}`)
+      - traefik.http.services.ksan-dev.loadbalancer.server.port=3000
+
+networks:
+  frontend:
+    external: true