Build Caddy with the caddy-dns/desec module

Stock caddy:2-alpine plus caddy-dns/desec, for ACME DNS-01 against zones
hosted at deSEC (*.llm.aneur.in in cloud/cloud's llm stack). CI builds
and checks the module on pull requests, and pushes :latest (keeping
:previous) on main, weekly and by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/pr-checks.yml

@@ -0,0 +1,23 @@
+name: PR Checks
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    container:
+      image: docker:cli
+    steps:
+      - name: Install Node (for checkout)
+        run: apk add --no-cache nodejs
+
+      - uses: actions/checkout@v4
+
+      - name: Build
+        run: docker build --pull --tag caddy-desec-docker:check .
+
+      - name: Check the deSEC module is built in
+        run: docker run --rm caddy-desec-docker:check caddy list-modules | grep -x dns.providers.desec