Add CI deploy via scoped rsync instead of a manual Ansible run

Previously this site had no CI at all — deploys went through a
forced-command SSH key that ran a fixed script cloning the repo and
building on the production host directly. Now CI builds the site in
an isolated container and pushes the output via rsync to a
forced-command key restricted (via rrsync) to this site's own docroot
only, matching the pattern now used across all the other Hugo sites.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -0,0 +1,34 @@
+name: deploy
+on:
+  push:
+    branches: [main]
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    container:
+      image: hugomods/hugo:exts
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - name: Install rsync + ssh client
+        run: |
+          if command -v apk >/dev/null; then
+            apk add --no-cache rsync openssh-client
+          else
+            apt-get update && apt-get install -y rsync openssh-client
+          fi
+      - run: hugo --minify -d public
+      - name: Deploy via rsync
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          # The server-side key is forced-command, restricted via rrsync to
+          # this site's own docroot only (see the static-site-deploy
+          # Ansible role) — it can push new files but can never read/list
+          # anything back off the server, and can't reach any other site's
+          # directory regardless of what path is requested here.
+          rsync -az --delete -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new" public/ root@sunfloweracres.reground.org:
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}