ci: build, push and deploy to personal cluster on push to master

- Gitea Actions workflow: build, push sha-tagged image, apply kustomize, wait for rollout with auto-rollback
- Deploy to personal-site namespace, served at jesseinit.dev with TLS
- Run container as non-root and bind to 0.0.0.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -16,8 +16,12 @@ RUN npm run build
 # Run
 FROM base AS run
 ENV NODE_ENV=production
-RUN mkdir .next
-COPY --from=build /app/public ./public
-COPY --from=build /app/.next/standalone ./
-COPY --from=build /app/.next/static ./.next/static
+ENV HOSTNAME=0.0.0.0
+ENV PORT=3000
+RUN mkdir .next && chown node:node .next
+COPY --from=build --chown=node:node /app/public ./public
+COPY --from=build --chown=node:node /app/.next/standalone ./
+COPY --from=build --chown=node:node /app/.next/static ./.next/static
+USER node
+EXPOSE 3000
 CMD ["node", "server.js"]