ci: add Forgejo CI/CD pipeline with docker save/load deploy to prod

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/deploy.yml

@@ -0,0 +1,52 @@
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build-and-deploy:
+    runs-on: shell
+    steps:
+      - name: Clone repository
+        run: git clone --depth 1 "http://192.168.8.174:3000/${GITHUB_REPOSITORY}.git" .
+        env:
+          GIT_TERMINAL_PROMPT: '0'
+
+      - name: Ensure Docker CLI
+        run: |
+          apk add --no-cache docker-cli docker-cli-compose openssh-client || true
+          grep -q '^vrubel:' /etc/passwd || echo 'vrubel:x:1000:1000::/data:/bin/sh' >> /etc/passwd
+
+      - name: Setup .env for CI/CD
+        run: cp .env.example .env
+
+      - name: Build Docker images
+        run: docker-compose build
+
+      - name: Login to Gitea Container Registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login http://192.168.8.174:3000 -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Push images to registry
+        run: |
+          docker push 192.168.8.174:3000/vrubel/lichess-api:latest
+          docker push 192.168.8.174:3000/vrubel/lichess-bot:latest
+          docker push 192.168.8.174:3000/vrubel/lichess-admin:latest
+          docker push 192.168.8.174:3000/vrubel/lichess-web:latest
+
+      - name: Transfer images to prod
+        run: |
+          docker save \
+            192.168.8.174:3000/vrubel/lichess-api:latest \
+            192.168.8.174:3000/vrubel/lichess-bot:latest \
+            192.168.8.174:3000/vrubel/lichess-admin:latest \
+            192.168.8.174:3000/vrubel/lichess-web:latest \
+          | ssh -i /data/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@130.17.6.76 docker load
+
+      - name: Deploy on prod host
+        run: |
+          cat docker-compose.prod.yml | ssh -i /data/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@130.17.6.76 \
+            "cat > ~/services/LichessStatTgWeb/docker-compose.yml"
+          ssh -i /data/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@130.17.6.76 \
+            "cd ~/services/LichessStatTgWeb && docker compose up -d --remove-orphans"