deploy: machine deployment — quadlets (gitea, nginx, isolated build network), poll+build pipeline, runbook

Reviewed (Opus security review, all findings verified) and tested end-to-end
locally: cold build 23s, no-op poll 45ms, incremental rebuild 4s, prune,
gitea-down grace, real bridge network with container DNS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012jWfn3RwPfFGTtBddm36Uy

deploy/nginx.conf

@@ -0,0 +1,30 @@
+# CTAO portal demo — static serving. The cache split is what makes the
+# 10-second publish loop feel instant: HTML is revalidated on every request
+# (a symlink flip shows up on the next refresh), fingerprinted assets are
+# cached forever.
+server {
+  listen 80;
+  server_name _;
+  root /srv/releases/current;
+  charset utf-8;
+  error_page 404 /404.html;    # Astro emits 404.html at the site root
+
+  # Fingerprinted build assets (/_astro/<name>.<hash>.*) — immutable
+  location /_astro/ {
+    add_header Cache-Control "public, max-age=31536000, immutable";
+  }
+
+  # Editor-uploaded media (stable paths, may be re-uploaded) — short cache
+  location /uploads/ {
+    add_header Cache-Control "public, max-age=3600";
+  }
+
+  # Everything else: HTML pages, feeds, /admin (Sveltia is static files too)
+  location / {
+    try_files $uri $uri/ =404;
+    add_header Cache-Control "no-cache";
+  }
+
+  gzip on;
+  gzip_types text/css application/javascript application/json image/svg+xml application/rss+xml text/xml;
+}