feat: Docker images, compose stacks, nginx config, Gitea CI

- site image: multi-stage node build -> unprivileged nginx (non-root, read-only)
- nginx: CSP + security headers, immutable asset caching, revalidated HTML,
  canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404
- externalise theme-init so CSP uses script-src 'self' (no inline hash)
- prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user)
- Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main
- verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

site/src/components/core/ThemeScript.astro

@@ -1,24 +1,9 @@
 ---
 /*
-  No-flash theme init. Runs before paint, sets data-theme from stored preference
-  or system (ANIMATION_SPEC — the one permitted inline script; CSP-hashed at the
-  nginx layer). First visit follows the system; once set, the choice persists.
+  No-flash theme init. Loaded as an external, render-blocking script (served from
+  /theme-init.js) so a strict CSP can allow script-src 'self' without inline hashes.
+  Runs before first paint. See public/theme-init.js.
 */
 ---
 
-<script is:inline>
-  (function () {
-    // Mark that JS is available; reveal animations are gated behind html.js so
-    // content stays visible without JavaScript.
-    document.documentElement.classList.add('js');
-    try {
-      let t = localStorage.getItem('theme');
-      if (t !== 'light' && t !== 'dark') {
-        t = window.matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark';
-      }
-      document.documentElement.dataset.theme = t;
-    } catch {
-      document.documentElement.dataset.theme = 'dark';
-    }
-  })();
-</script>
+<script is:inline src="/theme-init.js"></script>