deploy: publish site on host port 1337; nginx proxies /api/contact; auto-deploy

- site nginx listens on 1337; proxies /api/contact to the relay over the internal
  network (single public port; TLS terminates upstream at Cloudflare)
- trailing-slash rewrite moved inside location / so /api/contact isn't redirected
- compose: publish ${SITE_PORT:-1337}, internal bridge network, no Traefik labels
  (non-destructive — does not touch the WordPress apex router)
- .gitea/workflows/deploy.yml: on push to main, runner rebuilds + restarts the stack

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

site/Dockerfile

@@ -14,5 +14,5 @@ RUN pnpm build
 FROM nginxinc/nginx-unprivileged:1.27-alpine AS final
 COPY --chown=nginx:nginx nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build --chown=nginx:nginx /app/dist /usr/share/nginx/html
-EXPOSE 8080
+EXPOSE 1337
 # runs as uid 101 (nginx) by default in this image

site/nginx.conf

@@ -3,7 +3,7 @@
 # trailing slashes, the preserved /Linkedin redirect, and legacy-WP 410s.
 
 server {
-    listen 8080;
+    listen 1337;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;
@@ -32,6 +32,14 @@ server {
         return 301 https://www.linkedin.com/in/connor-babbington;
     }
 
+    # --- Contact relay (same-origin; single public port) ---
+    location = /api/contact {
+        proxy_pass http://relay:8081;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
     # --- Legacy WordPress URLs -> 410 Gone (crawler cleanup) ---
     location ~* ^/(wp-admin|wp-login|wp-content|wp-includes|wp-json|xmlrpc\.php|feed|comments/feed) {
         return 410;
@@ -59,11 +67,10 @@ server {
         add_header Cache-Control "public, must-revalidate" always;
     }
 
-    # --- Canonical trailing slash for extensionless paths (SEO) ---
-    rewrite ^([^.]*[^/])$ $1/ permanent;
-
-    # --- HTML documents: revalidate so deploys are instant (inherits headers above) ---
+    # --- HTML documents: canonical trailing slash + revalidate. Kept inside the
+    #     catch-all so exact routes (e.g. /api/contact) are never slash-redirected. ---
     location / {
+        rewrite ^([^.]*[^/])$ $1/ permanent;
         try_files $uri $uri/ =404;
     }