content split + copy audit + css polish: content (news/pages/uploads) moves to the ctao/content repo (build overlays it — two-repo build.sh, link-content.sh for local dev); portal copy trimmed to source-documents-only (dashboard empty states, minimal privacy/disclaimer, no mock badges); css: inverted selection on navy bands, featured-card text-track floor, 44px toc target, mobile search dates on own line, footer link row gap; DESIGN.md rewritten as a short handoff

deploy/README.md

@@ -4,15 +4,20 @@ Everything runs rootless as user `strapi`. Footprint on the machine:
 ONE directory (`~/ctao-portal-demo/`) + 4 unit files in `~/.config/`.
 Uninstall restores the machine exactly (see bottom). No secrets in any file.
 
+Two Gitea repos by design — `ctao/portal` (code, developed by the team) and
+`ctao/content` (Markdown + uploads, committed by the CMS). The build overlays
+content onto code; a push to EITHER republishes the site.
+
 ```
 ~/ctao-portal-demo/
 ├── gitea-data/    # Gitea state (repos, SQLite, accounts)  ← the ONLY thing worth backing up
 ├── gitea-config/  # Gitea app.ini (generated from env)
-├── repo/          # clone of the portal repo (created by first build)
-├── releases/      # <sha>/ dirs + `current` symlink (what nginx serves)
-├── state/         # last-built SHA
+├── repo/          # clone of the code repo (created by first build)
+├── content/       # clone of the content repo (created by first build)
+├── releases/      # <code>-<content>/ dirs + `current` symlink (what nginx serves)
+├── state/         # last-built release id
 ├── npm-cache/     # npm cache for the build container (created by build.sh)
-├── bin/build.sh   # copied from deploy/ (source of truth stays in the repo)
+├── bin/build.sh   # copied from deploy/ (source of truth stays in the code repo)
 └── config/nginx.conf
 ```
 
@@ -47,10 +52,11 @@ missing). Everything else runs inside containers.
 6. **[W]** Create the Gitea admin — run interactively in a terminal so the
    password never lands in a file or shell history:
    `podman exec -it ctao-demo-gitea gitea admin user create --admin --username <you> --email <you@…> --random-password`
-7. **[W]** In the Gitea UI: create org `ctao`, repo `portal` (public read).
-   Then, from your workstation, push the portal repo over the vhost with a
-   repo-scoped token:
+7. **[W]** In the Gitea UI: create org `ctao` with repos `portal` and
+   `content` (both public read). Then, from your workstation, push both over
+   the vhost with a repo-scoped token:
    `git push https://<user>:<token>@astro-git.isl-dev.grid.cyfronet.pl/ctao/portal.git main`
+   `git push https://<user>:<token>@astro-git.isl-dev.grid.cyfronet.pl/ctao/content.git main`
 8. **[W]** `systemctl --user enable --now ctao-portal-build.timer` — first run
    clones + `npm ci` + builds (minutes); later runs are seconds. Wait until
    `journalctl --user -u ctao-portal-build -n 5` shows `published <sha>`
@@ -88,7 +94,8 @@ loginctl disable-linger $USER   # only if nothing else of yours should survive l
 
 ## Notes
 
-- **Only site content auto-deploys.** Changes to `deploy/*` need a manual
+- **Only pushes to the machine's Gitea auto-deploy** (code and content repos
+  alike). Changes to `deploy/*` need a manual
   re-copy: `build.sh` → `bin/`, `nginx.conf` → `config/` +
   `systemctl --user restart ctao-demo-web`, unit files →
   `~/.config/…` + `systemctl --user daemon-reload` (+ restart). This is