feat(deploy): self-hosted CI/CD + dedicated edge-proxy topology

Refactor the site container from a TLS-owning, port-binding proxy into an
internal plaintext static server that sits behind a dedicated edge reverse
proxy, and add an automated build/deploy pipeline.

- Caddyfile: single :80 listener (auto_https off), Host-matcher routing for
  apex/blog/art/code with /_astro+/assets re-root and www->apex redirect
- Dockerfile: EXPOSE 80 only (TLS now handled by the edge proxy)
- compose.yml: pull registry image, join external 'edge' network, declare
  routing via caddy-docker-proxy labels; drop build/ports/cert volumes
- compose.dev.yml: local container preview on :8080
- .forgejo/workflows/deploy.yml: push-to-main -> desktop runner builds, pushes
  to the Forgejo registry, SSH-deploys to the VPS
- docs + .dockerignore updated for the new topology

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/deploy.yml

@@ -0,0 +1,64 @@
+# ----------------------------------------------------------------------------
+# Build + deploy jb-website.
+#
+# Runs on the home-desktop host runner (label `desktop`): builds the image,
+# pushes it to the Forgejo container registry, then SSHes to the VPS to pull
+# and restart. The VPS never builds — it only runs the prebuilt image.
+#
+# Required Forgejo settings (Repo > Settings > Actions):
+#   Variables:
+#     REGISTRY_OWNER   lowercase Forgejo user/org that owns the package
+#   Secrets:
+#     REGISTRY_USER    Forgejo username for `docker login`
+#     REGISTRY_TOKEN   Forgejo PAT with write:package scope
+#     DEPLOY_HOST      VPS host/IP
+#     DEPLOY_USER      SSH user on the VPS (deploy account)
+#     DEPLOY_SSH_KEY   private key whose public half is in the VPS authorized_keys
+# ----------------------------------------------------------------------------
+
+name: deploy
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: git.joshbairstow.com
+  IMAGE_NAME: jb-website
+
+jobs:
+  build-and-deploy:
+    runs-on: desktop
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Resolve image reference
+        run: |
+          IMAGE="${REGISTRY}/${{ vars.REGISTRY_OWNER }}/${IMAGE_NAME}"
+          echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"
+          echo "Building ${IMAGE}:${{ github.sha }}"
+
+      - name: Log in to the Forgejo registry
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" \
+            | docker login "${REGISTRY}" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Build and push image
+        run: |
+          docker build -t "${IMAGE}:${{ github.sha }}" -t "${IMAGE}:latest" .
+          docker push "${IMAGE}:${{ github.sha }}"
+          docker push "${IMAGE}:latest"
+
+      - name: Deploy to VPS over SSH
+        run: |
+          install -m 600 /dev/null deploy_key
+          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > deploy_key
+          ssh -i deploy_key -o StrictHostKeyChecking=accept-new \
+            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
+            "export REGISTRY_OWNER='${{ vars.REGISTRY_OWNER }}' TAG='${{ github.sha }}'; \
+             cd /opt/jb-website && \
+             docker compose -f compose.yml pull && \
+             docker compose -f compose.yml up -d && \
+             docker image prune -f"
+          rm -f deploy_key