feat: Docker images, compose stacks, nginx config, Gitea CI

- site image: multi-stage node build -> unprivileged nginx (non-root, read-only)
- nginx: CSP + security headers, immutable asset caching, revalidated HTML,
  canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404
- externalise theme-init so CSP uses script-src 'self' (no inline hash)
- prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user)
- Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main
- verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/.env.example

@@ -0,0 +1,18 @@
+# Copy to .env and fill in. Secrets never go in git or in the image (DOCKER_SPEC §3).
+
+# --- Contact relay: SMTP (submission endpoint of your mail provider) ---
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=            # secret — provide via env file (chmod 600) or a Docker secret
+RELAY_FROM=              # optional From address; defaults to SMTP_USER / RELAY_TO
+RELAY_TO=connor.babbington@cesnimda.co.uk
+RELAY_ALLOWED_ORIGIN=https://cesnimda.co.uk
+RELAY_RATE_LIMIT=5       # requests per window per IP
+RELAY_WINDOW_SECONDS=600
+
+# --- Site build ---
+PUBLIC_SITE_URL=https://cesnimda.co.uk
+
+# --- Infra ---
+PROXY_NETWORK=web        # name of the existing external reverse-proxy docker network