Add Gitea Action to build and push the image for Komodo deploys

Multi-stage Dockerfile builds the web bundle, embeds it into the static
Go binary (CGO_ENABLED=0), and ships it in a minimal alpine runtime:
non-root user, ca-certificates + tzdata, SQLite on a /data volume,
healthcheck on /api/v1/healthz, OCI provenance labels.

build-image.yml pushes to the Gitea registry on every branch push:
  * main             -> :latest
  * any other branch -> :<branch-name> (sanitized to valid tag chars)
  * every build      -> :sha-<short>   (immutable, for pinning)

A push to a PR branch covers the PR, so there is no separate
pull_request trigger. README documents the image, tags, and a
docker run / Komodo compose snippet. Modeled on mort's CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

README.md

@@ -58,3 +58,42 @@ All configuration is via environment variables; every value has a default, so `.
 | `PANSY_TRUSTED_PROXIES`   | *(none)*           | Comma-separated proxy CIDRs/IPs to trust for client-IP resolution. |
 
 Auth variables are read at startup now and consumed as the auth features land (issues #4/#5).
+
+## Docker & deployment
+
+CI (`.gitea/workflows/build-image.yml`) builds the single-binary image and pushes it to the Gitea registry on every branch push:
+
+| Ref | Tag |
+| --- | --- |
+| `main` | `gitea.stevedudenhoeffer.com/steve/pansy:latest` |
+| any other branch | `gitea.stevedudenhoeffer.com/steve/pansy:<branch-name>` |
+| every build | `gitea.stevedudenhoeffer.com/steve/pansy:sha-<short>` (immutable; use to pin) |
+
+The image runs as a non-root user, serves on `:8080`, and stores the SQLite database on the `/data` volume. Run it directly:
+
+```sh
+docker run -d --name pansy \
+  -p 8080:8080 \
+  -v pansy-data:/data \
+  gitea.stevedudenhoeffer.com/steve/pansy:latest
+```
+
+Or as a Komodo/Compose stack:
+
+```yaml
+services:
+  pansy:
+    image: gitea.stevedudenhoeffer.com/steve/pansy:${PANSY_TAG:-latest}
+    ports:
+      - "8080:8080"
+    volumes:
+      - pansy-data:/data
+    environment:
+      PANSY_BASE_URL: https://pansy.example.com
+      # PANSY_OIDC_ISSUER: ...   # once auth (#5) lands
+    restart: unless-stopped
+volumes:
+  pansy-data:
+```
+
+Pin `PANSY_TAG` to a `sha-<short>` tag for reproducible deploys, or leave it at `latest` to track `main`.