ci: Add Gitea Actions deploy workflow

Build the frontend and the Go share-service, rsync/scp both to the Caddy
host, and restart share-svc + reload caddy. Triggers on push to master
(and manual dispatch). Requires a DEPLOY_SSH_KEY secret; host/user/paths
default to the Justfile values and are overridable via repo variables.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -0,0 +1,73 @@
+name: Deploy
+
+# Builds the static frontend and the Go share-service, ships both to the
+# Caddy host, and restarts the service.
+#
+# Required repo secret:
+#   DEPLOY_SSH_KEY  - private SSH key authorized for ${DEPLOY_USER}@${DEPLOY_HOST}
+#
+# Override host/user/paths via repo variables (Settings > Actions > Variables)
+# if they ever change; the defaults below match the Justfile.
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+env:
+  DEPLOY_HOST: ${{ vars.DEPLOY_HOST || 'goldfish.malzahn.lan' }}
+  DEPLOY_USER: ${{ vars.DEPLOY_USER || 'root' }}
+  WWW_ROOT: ${{ vars.WWW_ROOT || '/usr/share/caddy/public_html/fabula' }}
+  GO_ARCH: ${{ vars.GO_ARCH || 'amd64' }}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # --- Build frontend ---
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm run build # -> dist/
+
+      # --- Build backend (static, no cgo) ---
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: server/go.mod
+          cache-dependency-path: server/go.sum
+      - name: Build share-svc
+        working-directory: server
+        run: CGO_ENABLED=0 GOOS=linux GOARCH="$GO_ARCH" go build -o share-svc .
+
+      # --- Deploy ---
+      - name: Configure SSH
+        run: |
+          command -v rsync >/dev/null || { apt-get update && apt-get install -y rsync; }
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          install -m 600 /dev/stdin ~/.ssh/deploy_key <<< "${{ secrets.DEPLOY_SSH_KEY }}"
+          ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Copy frontend
+        run: |
+          rsync -az --delete -e "ssh -i ~/.ssh/deploy_key" \
+            dist/ "$DEPLOY_USER@$DEPLOY_HOST:$WWW_ROOT/"
+
+      - name: Copy backend binary + unit file
+        run: |
+          scp -i ~/.ssh/deploy_key server/share-svc \
+            "$DEPLOY_USER@$DEPLOY_HOST:/usr/local/bin/share-svc"
+          scp -i ~/.ssh/deploy_key server/share-svc.service \
+            "$DEPLOY_USER@$DEPLOY_HOST:/etc/systemd/system/share-svc.service"
+
+      - name: Restart services
+        run: |
+          ssh -i ~/.ssh/deploy_key "$DEPLOY_USER@$DEPLOY_HOST" '
+            systemctl daemon-reload &&
+            systemctl enable --now share-svc &&
+            systemctl restart share-svc &&
+            systemctl reload caddy
+          '