feat: deploy (Dockerfile, compose) and Gitea Actions CI

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/.env.example

@@ -0,0 +1,5 @@
+# Copy to deploy/.env and fill in.
+# Public hostname of the course (a DNS A/AAAA record must point at this server).
+COURSE_HOST=course.example.com
+# Name of the Docker network nginx-proxy is attached to.
+PROXY_NETWORK=nginx-proxy

deploy/Dockerfile

@@ -0,0 +1,14 @@
+# Build context is the repository root:
+#   docker build -f deploy/Dockerfile --build-arg COURSE_HOST=course.example.com .
+FROM node:22-alpine AS build
+ARG COURSE_HOST
+RUN test -n "$COURSE_HOST" || (echo "COURSE_HOST build arg is required" >&2; exit 1)
+ENV COURSE_HOST=$COURSE_HOST
+WORKDIR /app
+COPY . ./
+RUN npm --prefix site ci --no-audit --no-fund
+RUN npm --prefix site run build
+
+FROM nginx:alpine
+COPY --from=build /app/site/dist /usr/share/nginx/html
+EXPOSE 80

deploy/README.md

@@ -0,0 +1,38 @@
+# Deploying the course site
+
+The site (`site/`, Astro Starlight) is built into static files and served by
+`nginx:alpine`. It is meant to run behind a `jwilder/nginx-proxy` container with
+`acme-companion` (Let's Encrypt), which routes by the `VIRTUAL_HOST` variable.
+
+## Deploy
+
+```sh
+git clone https://gitea.lucaswinther.info/lucasw89/systemic-game-design-course.git
+cd systemic-game-design-course/deploy
+cp .env.example .env      # set COURSE_HOST (and PROXY_NETWORK if yours differs)
+docker compose up -d --build
+```
+
+- `COURSE_HOST` is the public hostname; point its DNS record at the server first.
+  It is used as the site URL at build time, as `VIRTUAL_HOST`, and as `LETSENCRYPT_HOST`.
+- The build fails if `COURSE_HOST` is unset, so the placeholder URL never ships.
+- The container joins the external Docker network `${PROXY_NETWORK:-nginx-proxy}`;
+  it must be the network your nginx-proxy container is on.
+- To update: `git pull && docker compose up -d --build`.
+
+Manual build: `docker build -f deploy/Dockerfile --build-arg COURSE_HOST=course.example.com .`
+(run from the repository root).
+
+## CI
+
+`.gitea/workflows/ci.yml` runs on Gitea Actions (needs a runner with the `ubuntu-latest` label):
+
+| Job | Runs |
+| --- | --- |
+| `tools` | `npm run test:tools`, `npm run check` (sync-check), `npm run test:site` |
+| `verify-references` | `node tools/verify-references.mjs`: every module's reference, Rust and TS, with cumulative tests (needs network for `npm install`; Rust pinned to 1.85.1) |
+| `coupling-audit` | `tools/coupling-audit.mjs` on every `course/*/reference/*` |
+| `site` | `npm --prefix site ci && npm --prefix site run build` with a dummy `COURSE_HOST` |
+| `naive-engine` | Module 0's engine: `cargo test`, `npm test`, `npm run typecheck`. The whirlwind-order test is expected to fail and is marked `should_panic` / `test.fails`, so the suite passes |
+
+There is no clippy step.

deploy/docker-compose.yml

@@ -0,0 +1,21 @@
+services:
+  course:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile
+      args:
+        COURSE_HOST: ${COURSE_HOST:?set COURSE_HOST in deploy/.env}
+    restart: unless-stopped
+    expose:
+      - "80"
+    environment:
+      VIRTUAL_HOST: ${COURSE_HOST}
+      LETSENCRYPT_HOST: ${COURSE_HOST}
+      VIRTUAL_PORT: "80"
+    networks:
+      - proxy
+
+networks:
+  proxy:
+    name: ${PROXY_NETWORK:-nginx-proxy}
+    external: true