- Gitea Actions workflow: build, push sha-tagged image, apply kustomize, wait for rollout with auto-rollback
- Deploy to personal-site namespace, served at jesseinit.dev with TLS
- Run container as non-root and bind to 0.0.0.0
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>