chore: initial VPS edge stack (caddy-docker-proxy + Forgejo)

Edge reverse proxy (TLS + label routing) and self-hosted Forgejo (git +
Actions + container registry) for joshbairstow.com, plus the desktop runner
config and the one-time bootstrap runbook.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

runner/config.yml

@@ -0,0 +1,38 @@
+# ----------------------------------------------------------------------------
+# Forgejo Actions runner config — runs on the HOME DESKTOP (not the VPS).
+#
+# The desktop does the heavy `docker build` and pushes the image to the VPS
+# registry, keeping the VPS light. Install the runner binary, then register and
+# run it pointed at this file. See ../README.md for the full sequence.
+#
+#   forgejo-runner register --no-interactive \
+#     --instance https://git.joshbairstow.com \
+#     --token <REGISTRATION_TOKEN> \
+#     --name desktop \
+#     --labels desktop:host         # ':host' = run jobs directly on this machine
+#
+#   forgejo-runner daemon --config config.yml
+# ----------------------------------------------------------------------------
+
+log:
+  level: info
+
+runner:
+  # Path to the registration file produced by `register` (keep it out of git).
+  file: .runner
+  capacity: 1
+  timeout: 30m
+  # `desktop:host` runs jobs directly on the desktop using its own Docker +
+  # ssh, which is what the workflow expects (`runs-on: desktop`). Host
+  # execution avoids mounting the docker socket into a job container.
+  labels:
+    - "desktop:host"
+
+container:
+  # Unused for host-label jobs, but harmless defaults if you later add
+  # docker-label runners for sandboxed jobs.
+  network: ""
+  privileged: false
+
+cache:
+  enabled: true