feat: Docker images, compose stacks, nginx config, Gitea CI

- site image: multi-stage node build -> unprivileged nginx (non-root, read-only)
- nginx: CSP + security headers, immutable asset caching, revalidated HTML,
  canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404
- externalise theme-init so CSP uses script-src 'self' (no inline hash)
- prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user)
- Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main
- verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

site/Dockerfile

@@ -0,0 +1,18 @@
+# syntax=docker/dockerfile:1
+
+# ---- build ----
+FROM node:22-alpine AS build
+WORKDIR /app
+RUN corepack enable
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+COPY . .
+ENV ASTRO_TELEMETRY_DISABLED=1
+RUN pnpm build
+
+# ---- runtime: static files behind unprivileged nginx (non-root, read-only capable) ----
+FROM nginxinc/nginx-unprivileged:1.27-alpine AS final
+COPY --chown=nginx:nginx nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build --chown=nginx:nginx /app/dist /usr/share/nginx/html
+EXPOSE 8080
+# runs as uid 101 (nginx) by default in this image