feat: Docker images, compose stacks, nginx config, Gitea CI

- site image: multi-stage node build -> unprivileged nginx (non-root, read-only)
- nginx: CSP + security headers, immutable asset caching, revalidated HTML,
  canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404
- externalise theme-init so CSP uses script-src 'self' (no inline hash)
- prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user)
- Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main
- verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

relay/Dockerfile

@@ -11,8 +11,8 @@ RUN dotnet publish -c Release -o /app --no-restore
 # ---- runtime ----
 FROM mcr.microsoft.com/dotnet/aspnet:9.0-alpine AS final
 WORKDIR /app
-RUN addgroup -S app && adduser -S app -G app
 COPY --from=build /app .
+# The .NET aspnet image ships a non-root `app` user.
 USER app
 ENV ASPNETCORE_URLS=http://+:8081 \
     DOTNET_EnableDiagnostics=0