deploy: publish site on host port 1337; nginx proxies /api/contact; auto-deploy

- site nginx listens on 1337; proxies /api/contact to the relay over the internal
  network (single public port; TLS terminates upstream at Cloudflare)
- trailing-slash rewrite moved inside location / so /api/contact isn't redirected
- compose: publish ${SITE_PORT:-1337}, internal bridge network, no Traefik labels
  (non-destructive — does not touch the WordPress apex router)
- .gitea/workflows/deploy.yml: on push to main, runner rebuilds + restarts the stack

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -0,0 +1,16 @@
+name: Deploy
+
+# Auto-deploy on push to main. Runs on the self-hosted Gitea runner (which has the
+# host Docker socket) and rebuilds + restarts the stack on the same host.
+# The public site ends up on host port 1337 (see deploy/docker-compose.yml).
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build and (re)start the stack
+        run: docker compose -f deploy/docker-compose.yml up -d --build --remove-orphans