feat(deploy): self-hosted CI/CD + dedicated edge-proxy topology

Refactor the site container from a TLS-owning, port-binding proxy into an
internal plaintext static server that sits behind a dedicated edge reverse
proxy, and add an automated build/deploy pipeline.

- Caddyfile: single :80 listener (auto_https off), Host-matcher routing for
  apex/blog/art/code with /_astro+/assets re-root and www->apex redirect
- Dockerfile: EXPOSE 80 only (TLS now handled by the edge proxy)
- compose.yml: pull registry image, join external 'edge' network, declare
  routing via caddy-docker-proxy labels; drop build/ports/cert volumes
- compose.dev.yml: local container preview on :8080
- .forgejo/workflows/deploy.yml: push-to-main -> desktop runner builds, pushes
  to the Forgejo registry, SSH-deploys to the VPS
- docs + .dockerignore updated for the new topology

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

compose.yml

@@ -1,26 +1,35 @@
 # ----------------------------------------------------------------------------
-# jb-website — production compose file.
+# jb-website — PRODUCTION compose (lives on the VPS at /opt/jb-website/).
 #
-# Runs the Caddy-fronted static site. Caddy handles HTTPS via the automatic
-# ACME flow at the email configured in Caddyfile. Side-hustle container
-# services (signage, keycaps, etc.) would slot in alongside this one — Caddy
-# in this container can proxy to them, or you can put a dedicated Caddy in
-# front of all containers.
+# This file does NOT build. The image is built on the home-desktop CI runner
+# and pushed to the Forgejo container registry; the VPS only pulls and runs it.
+# The deploy step (see .forgejo/workflows/deploy.yml) does:
+#
+#   TAG=<commit-sha> docker compose -f /opt/jb-website/compose.yml pull
+#   TAG=<commit-sha> docker compose -f /opt/jb-website/compose.yml up -d
+#
+# Routing + TLS are handled by the edge proxy (caddy-docker-proxy, infra repo).
+# This service is internal-only: no published ports, no certs. It joins the
+# shared external `edge` network and declares its hostnames via labels; the edge
+# proxy discovers them and reverse-proxies (plaintext, Host preserved) to :80.
+#
+# For local preview use compose.dev.yml instead (this file won't run off-VPS
+# because the `edge` network is external).
 # ----------------------------------------------------------------------------
 
 services:
   web:
-    build: .
-    image: jb-website:latest
+    # REGISTRY_OWNER must be the lowercase Forgejo owner (user/org). TAG is the
+    # commit sha set by the deploy step; falls back to latest for manual `up`.
+    image: git.joshbairstow.com/${REGISTRY_OWNER:-josh}/jb-website:${TAG:-latest}
     container_name: jb-website
     restart: unless-stopped
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - caddy_data:/data
-      - caddy_config:/config
+    networks:
+      - edge
+    labels:
+      caddy: joshbairstow.com, www.joshbairstow.com, blog.joshbairstow.com, art.joshbairstow.com, code.joshbairstow.com
+      caddy.reverse_proxy: "{{upstreams 80}}"
 
-volumes:
-  caddy_data:
-  caddy_config:
+networks:
+  edge:
+    external: true