website: switch to typed PayloadCMS SDK via @unom/cms

- Add @payloadcms/sdk + @unom/cms (typed Config) to deps
- .npmrc maps @unom to git.unom.io/api/packages/unom/npm/
- Rewrite src/lib/cms.ts: PayloadSDK<Config> client + typed helpers
  (findPageBySlug, findPostBySlug, findPosts, findFooter, findHeader)
- Re-export the structural types (Page, Post, Footer, Header) plus the
  legacy aliases (RichTextBlock, LexRoot/LexNode, NavigationSection,
  NavigationLink) so existing components keep compiling
- Dockerfile mounts /root/.npmrc as a build secret so bun install can
  pull @unom/cms from the private gitea registry
- deploy.yml stages an .npmrc with REGISTRY_TOKEN auth + passes it as
  the 'npmrc' build secret
- Add blog routes: /blog (list) + /blog/ (detail), PostCard, all
  reading from the CMS via the SDK
- Fix two pre-existing TS errors (@fontsource/inter import, server.tsx
  return type)

package.json

@@ -16,10 +16,12 @@
 	},
 	"dependencies": {
 		"@fontsource/inter": "^5.2.5",
+		"@payloadcms/sdk": "^3.84.1",
 		"@tailwindcss/vite": "^4.3.0",
 		"@tanstack/react-router": "latest",
 		"@tanstack/react-start": "latest",
 		"@tanstack/router-plugin": "^1.168.9",
+		"@unom/cms": "^0.1.0",
 		"class-variance-authority": "^0.7.1",
 		"clsx": "^2.1.1",
 		"nitro": "^3.0.260429-beta",