ci: add Gitea Actions workflow + fix docker-compose for registry pull

Workflow (3 jobs, all on the local netork-runner on 10.7.224.11):

  typecheck (ubuntu-latest)
    → npm ci + tsc --noEmit on every push/PR

  publish (ubuntu-latest, main only)
    → docker build + push to registry.netork.io/netork/website:latest
      and registry.netork.io/netork/website:main-<sha>

  deploy (build/host, after publish)
    → runs directly on the host (no SSH needed)
    → copies docker-compose.yml to /opt/netork-website/
    → docker compose pull + up -d --remove-orphans

docker-compose.yml: replaced local build: . with
registry.netork.io/netork/website:latest so the deploy job
pulls the just-published image instead of building again.

Required Gitea secrets: REGISTRY_USER, REGISTRY_PASSWORD

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -1,7 +1,6 @@
 services:
   netork-website:
-    build: .
-    image: netork-website:latest
+    image: registry.netork.io/netork/website:latest
     container_name: netork-website
     restart: unless-stopped
     expose: