build on Gitea, push to the Gitea registry

This repo now lives on git.ffaerber.duckdns.org and its image is consumed by the
homelab swarm, so the build moves with it: .gitea/workflows/docker.yml builds on
the homelab runner and pushes to this Gitea's registry as an immutable short-SHA
tag plus :latest.

Build-only, on purpose. The GitHub workflow it replaces also SSHed into the
Hostinger VPS and ran `docker stack deploy` on every push to main, which
deploys the machine being retired and makes a deploy a side effect of a push.
The homelab pattern is a PR bumping the tag in ffaerber/homelab, so shipping is
a reviewed commit.

Plain `docker build` rather than buildx: the runner shares the host daemon
through a mounted socket, and buildx's gha cache backend does not exist outside
GitHub.

.github/workflows is removed from this copy so Gitea does not also try to run
it -- it would log in to ghcr with a Gitea token and SSH to a host whose secrets
are not here. The GitHub repository keeps its own copy untouched.

.gitea/workflows/docker.yml

@@ -0,0 +1,49 @@
+name: Docker
+# Builds the hosted-gateway image for the homelab instance and pushes it to this
+# Gitea's own registry. Deliberately build-only: the GitHub workflow this
+# replaces also SSHed into the Hostinger VPS and redeployed it, which is the
+# machine being retired. Here the image is deployed the way everything else in
+# the homelab is -- a PR bumping the tag in ffaerber/homelab's docker-compose.yml
+# -- so a deploy is a reviewed commit rather than a side effect of a push.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    # The homelab runner (a container on pluto, sharing the host docker daemon).
+    runs-on: ci-runner
+    steps:
+      - uses: actions/checkout@v4
+
+      # Plain docker rather than buildx: the runner already has the host daemon
+      # on a mounted socket, and the gha cache backend buildx wants does not
+      # exist here.
+      - name: Build
+        run: |
+          set -eu
+          SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          echo "IMAGE=git.ffaerber.duckdns.org/token-for-token/hosted-gateway" >> "$GITHUB_ENV"
+          echo "SHA=$SHA" >> "$GITHUB_ENV"
+          docker build --build-arg COMMIT_SHA=${{ github.sha }} \
+            -t "git.ffaerber.duckdns.org/token-for-token/hosted-gateway:$SHA" .
+
+      # Pull requests build to prove the Dockerfile still works, and stop there.
+      - name: Push
+        if: github.event_name != 'pull_request'
+        run: |
+          set -eu
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.ffaerber.duckdns.org -u "${{ github.actor }}" --password-stdin
+          docker tag "$IMAGE:$SHA" "$IMAGE:latest"
+          docker push "$IMAGE:$SHA"
+          docker push "$IMAGE:latest"
+          docker logout git.ffaerber.duckdns.org
+          {
+            echo "### Pushed"
+            echo
+            echo '```'
+            echo "$IMAGE:$SHA"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"