website: switch to typed PayloadCMS SDK via @unom/cms

- Add @payloadcms/sdk + @unom/cms (typed Config) to deps
- .npmrc maps @unom to git.unom.io/api/packages/unom/npm/
- Rewrite src/lib/cms.ts: PayloadSDK<Config> client + typed helpers
  (findPageBySlug, findPostBySlug, findPosts, findFooter, findHeader)
- Re-export the structural types (Page, Post, Footer, Header) plus the
  legacy aliases (RichTextBlock, LexRoot/LexNode, NavigationSection,
  NavigationLink) so existing components keep compiling
- Dockerfile mounts /root/.npmrc as a build secret so bun install can
  pull @unom/cms from the private gitea registry
- deploy.yml stages an .npmrc with REGISTRY_TOKEN auth + passes it as
  the 'npmrc' build secret
- Add blog routes: /blog (list) + /blog/ (detail), PostCard, all
  reading from the CMS via the SDK
- Fix two pre-existing TS errors (@fontsource/inter import, server.tsx
  return type)

.gitea/workflows/deploy.yml

@@ -35,6 +35,15 @@ jobs:
         run: |
           printf '%s' "$REGISTRY_TOKEN" | docker login git.unom.io -u "$REGISTRY_USER" --password-stdin
 
+      - name: Stage .npmrc with @unom registry auth
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          cat > /tmp/.npmrc <<EOF
+          @unom:registry=https://git.unom.io/api/packages/unom/npm/
+          //git.unom.io/api/packages/unom/npm/:_authToken=${REGISTRY_TOKEN}
+          EOF
+
       - name: Build & push
         env:
           BUILDER: builder-unom-website
@@ -47,6 +56,7 @@ jobs:
             --file ./Dockerfile \
             --tag "$IMAGE:latest" \
             --tag "$IMAGE:$SHA" \
+            --secret id=npmrc,src=/tmp/.npmrc \
             --cache-from "type=registry,ref=$IMAGE:cache" \
             --cache-to "type=registry,ref=$IMAGE:cache,mode=min" \
             .