feat(ci): Gitea Actions — dockerized web/docs/rust-ci images, Apple client CI, Mac runner

Three workflows: ci.yml (Rust workspace inside the punktfunk-rust-ci
builder image + web/docs-site build+typecheck), docker.yml (build+push
punktfunk-web, punktfunk-docs, punktfunk-rust-ci to git.unom.io — host
and native clients stay un-dockerized by design), apple.yml (host-mode
macos-arm64 runner: Rust core -> PunktfunkCore.xcframework ->
swift build + swift test).

ci/rust-ci.Dockerfile: Ubuntu 26.04 with the workspace's link deps
(FFmpeg 8, PipeWire, Opus, GL/EGL/GBM, xkbcommon, libcuda via the
580-server userspace as a link stub) + pinned rustup + node for the JS
actions. Verified end to end in-container: build, 141/141 tests, C ABI
harness; all three images seeded to the registry manually.

scripts/ci/setup-macos-runner.sh provisions the Mac (rustup + darwin
targets, Node tarball, gitea-runner 1.0.8 host mode, LaunchAgent with
DEVELOPER_DIR auto-detect for sudo-free Xcode selection). Docs in
docs-site/content/docs/ci.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/Dockerfile

@@ -0,0 +1,29 @@
+# punktfunk management console — TanStack Start built with Bun, served by the Nitro `bun`
+# preset bundle. Build context is the REPO ROOT (orval generates the API client from
+# docs/api/openapi.json, referenced as ../docs/api/openapi.json from web/):
+#
+#   docker build -f web/Dockerfile -t punktfunk-web .
+#
+# Runtime: PORT (default 3000) and PUNKTFUNK_MGMT_URL (upstream management API the Nitro
+# server proxies /api to; see web/server/routes).
+FROM oven/bun:1 AS build
+WORKDIR /repo/web
+
+# Dependency layer: lockfile only, so source edits don't re-install.
+# --ignore-scripts: the root `prepare` script runs codegen, which needs sources that
+# aren't copied yet — `bun run build` regenerates everything below.
+COPY web/package.json web/bun.lock ./
+RUN bun install --frozen-lockfile --ignore-scripts
+
+COPY docs/api/openapi.json /repo/docs/api/openapi.json
+COPY web/ ./
+# prebuild runs orval (openapi → src/api/gen); the paraglide vite plugin compiles i18n.
+RUN bun run build
+
+FROM oven/bun:1-slim
+WORKDIR /app
+COPY --from=build /repo/web/.output ./.output
+USER bun
+ENV PORT=3000
+EXPOSE 3000
+CMD ["bun", "run", ".output/server/index.mjs"]