add Gitea CI/CD workflows and Dockerfile

CI runs go vet/build/test plus govulncheck on PRs. Build pushes a
latest/previous image to the Gitea registry on push to main, and
Release pushes a tag-matched image on git tags. Adapted from the
project-manager workflows.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  go-tests:
+    runs-on: ubuntu-latest
+    container: golang:1.25-alpine
+    steps:
+      # actions/checkout is a JS action -- golang:1.25-alpine has no node on
+      # PATH by default, so install it (musl-native, no glibc/Alpine mismatch)
+      # before any step that needs it.
+      - name: Install Node
+        run: apk add --no-cache nodejs
+
+      - uses: actions/checkout@v4
+
+      - name: Verify dependencies
+        run: go mod verify
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Build
+        run: go build ./...
+
+      - name: Test
+        run: go test ./...
+
+      - name: Audit dependencies
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          "$(go env GOPATH)/bin/govulncheck" ./...