deploy: publish site on host port 1337; nginx proxies /api/contact; auto-deploy

- site nginx listens on 1337; proxies /api/contact to the relay over the internal
  network (single public port; TLS terminates upstream at Cloudflare)
- trailing-slash rewrite moved inside location / so /api/contact isn't redirected
- compose: publish ${SITE_PORT:-1337}, internal bridge network, no Traefik labels
  (non-destructive — does not touch the WordPress apex router)
- .gitea/workflows/deploy.yml: on push to main, runner rebuilds + restarts the stack

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

site/Dockerfile

@@ -14,5 +14,5 @@ RUN pnpm build
 FROM nginxinc/nginx-unprivileged:1.27-alpine AS final
 COPY --chown=nginx:nginx nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build --chown=nginx:nginx /app/dist /usr/share/nginx/html
-EXPOSE 8080
+EXPOSE 1337
 # runs as uid 101 (nginx) by default in this image