Add build workflow

Builds and pushes the pass-cli image to code.aneur.in on every push to
main, based on zampler/zampler's build.yml pattern (registry login,
promote current latest to previous, build and push). Dropped everything
specific to that repo's own build (frontend/npm, Go cross-compilation,
multi-arch buildx) since this repo just builds one Dockerfile for one
architecture.

Uses its own BUILD_API_TOKEN secret, unrelated to Proton Pass -- build
workflows in this org are configured per-repo and don't go through
pass-cli, which is only for 'real world' deploy-time credentials.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -0,0 +1,45 @@
+# Builds and pushes the pass-cli image to code.aneur.in's registry.
+#
+# Single architecture (amd64) -- the Dockerfile pins a specific
+# pass-cli-linux-x86_64 binary, not a TARGETARCH-aware multi-arch build.
+#
+# Secrets:
+#   BUILD_API_TOKEN  registry push token for code.aneur.in (write:package)
+
+name: Build
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    container:
+      image: docker:cli
+    env:
+      IMAGE: code.aneur.in/${{ gitea.repository }}
+    steps:
+      - name: Install toolchain deps
+        run: apk add --no-cache nodejs docker-cli-buildx
+
+      - uses: actions/checkout@v4
+
+      - name: Log in to the container registry
+        env:
+          BUILD_API_TOKEN: ${{ secrets.BUILD_API_TOKEN }}
+        run: echo "$BUILD_API_TOKEN" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
+
+      - name: Promote current "latest" to "previous"
+        run: |
+          if docker buildx imagetools inspect "$IMAGE:latest" >/dev/null 2>&1; then
+            docker buildx imagetools create -t "$IMAGE:previous" "$IMAGE:latest"
+          else
+            echo "No existing :latest to promote; skipping."
+          fi
+
+      - name: Build and push "latest"
+        run: |
+          docker build -t "$IMAGE:latest" .
+          docker push "$IMAGE:latest"