website: switch to typed PayloadCMS SDK via @unom/cms

- Add @payloadcms/sdk + @unom/cms (typed Config) to deps
- .npmrc maps @unom to git.unom.io/api/packages/unom/npm/
- Rewrite src/lib/cms.ts: PayloadSDK<Config> client + typed helpers
  (findPageBySlug, findPostBySlug, findPosts, findFooter, findHeader)
- Re-export the structural types (Page, Post, Footer, Header) plus the
  legacy aliases (RichTextBlock, LexRoot/LexNode, NavigationSection,
  NavigationLink) so existing components keep compiling
- Dockerfile mounts /root/.npmrc as a build secret so bun install can
  pull @unom/cms from the private gitea registry
- deploy.yml stages an .npmrc with REGISTRY_TOKEN auth + passes it as
  the 'npmrc' build secret
- Add blog routes: /blog (list) + /blog/ (detail), PostCard, all
  reading from the CMS via the SDK
- Fix two pre-existing TS errors (@fontsource/inter import, server.tsx
  return type)

Dockerfile

@@ -7,8 +7,12 @@ RUN apk update && apk add --no-cache libc6-compat
 FROM base AS installer
 WORKDIR /app
 
-COPY package.json bun.lock ./
+COPY package.json bun.lock .npmrc ./
+# @unom/cms lives in the private gitea npm registry; CI mounts an .npmrc
+# with the auth token at /root/.npmrc as a build secret. Fall through to
+# the in-repo .npmrc (registry mapping only, no token) if no secret.
 RUN --mount=type=cache,target=/root/.bun/install/cache,sharing=shared \
+    --mount=type=secret,id=npmrc,target=/root/.npmrc \
     bun install --frozen-lockfile
 
 COPY . .