docs site: add MkDocs publishing layer (build, deploy, push-to-main webhook)

Renders the repository's Markdown (which stays where it is) into a
member-readable static site with Material for MkDocs: co-op brand colours
and logo, self-hosted OFL Figtree, offline search, no external hosts.

- publishing/build.sh   stage .site-src, render .site-build (mkdocs --strict)
- publishing/deploy.sh  write the build into the Surfer app container
- publishing/webhook-receiver.py + .service   Gitea push hook on main
                        triggers pull -> build -> deploy (agent host, no new
                        Cloudron app)

publishing/build.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Build the member-readable documentation site from this repository.
+#
+# The repository is the single source of truth. This script:
+#   1. stages a mirror of the documents into .site-src/ (generated, gitignored),
+#      because MkDocs cannot read the repository root directly;
+#   2. renders .site-src/ to .site-build/ with MkDocs + Material.
+#
+# No document is moved, renamed, or rewritten — the staging copy is a build
+# artifact and disappears with `--clean`.
+#
+# Usage:
+#   publishing/build.sh                 # create/use .venv-docs and build
+#   publishing/build.sh /path/to/venv   # use an existing venv
+#
+# In CI (Woodpecker), install the toolchain and run MkDocs directly:
+#   pip install -r publishing/requirements.txt && mkdocs build --strict
+
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_DIR"
+
+VENV="${1:-$REPO_DIR/.venv-docs}"
+SITE_SRC="$REPO_DIR/.site-src"
+
+# 1. Stage the documents (Markdown at the root, maintenance/, incidents/) plus
+#    the publishing assets (fonts, CSS, icon). Exclude tooling and build output.
+rm -rf "$SITE_SRC"
+mkdir -p "$SITE_SRC"
+tar cf - \
+  --exclude='.git' \
+  --exclude='.site-src' \
+  --exclude='.site-build' \
+  --exclude='.venv-docs' \
+  --exclude='*.sh' \
+  --exclude='publishing/webhook-receiver.py' \
+  --exclude='publishing/webhook-receiver.service' \
+  --exclude='mkdocs.yml' \
+  --exclude='.gitignore' \
+  --exclude='requirements.txt' \
+  . | tar xf - -C "$SITE_SRC"
+
+# 2. Build.
+if [ ! -x "$VENV/bin/mkdocs" ]; then
+  echo "Creating build venv at $VENV"
+  python3 -m venv "$VENV"
+  "$VENV/bin/pip" install --quiet --upgrade pip
+  "$VENV/bin/pip" install --quiet -r "$REPO_DIR/publishing/requirements.txt"
+fi
+
+echo "Building site -> $REPO_DIR/.site-build"
+"$VENV/bin/mkdocs" build --clean
+
+echo "Done: $REPO_DIR/.site-build"