docs site: add MkDocs publishing layer (build, deploy, push-to-main webhook)

Renders the repository's Markdown (which stays where it is) into a
member-readable static site with Material for MkDocs: co-op brand colours
and logo, self-hosted OFL Figtree, offline search, no external hosts.

- publishing/build.sh   stage .site-src, render .site-build (mkdocs --strict)
- publishing/deploy.sh  write the build into the Surfer app container
- publishing/webhook-receiver.py + .service   Gitea push hook on main
                        triggers pull -> build -> deploy (agent host, no new
                        Cloudron app)

publishing/deploy.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Publish the built documentation site to the Cloudron Surfer app.
+#
+# Surfer serves static files from inside its app container. The build is
+# written to two places:
+#   /app/data/public-docs/   the Surfer site bound to docs.inference.coop
+#                            (served at the root of that hostname)
+#   /app/data/public/docs/   a subdirectory of the marketing site, so the docs
+#                            stay viewable at https://inference.coop/docs/
+#
+# Mechanism (evidence: Cloudron app "Surfer" io.cloudron.surfer 7.4.1, and
+# repos/website/deploy.sh, which already deploys the marketing site this way):
+# pipe a tar of the build output into the container via `cloudron exec`, which
+# needs only the Cloudron API token — no WebDAV token, SFTP credentials or SSH.
+#
+# Usage:
+#   CLOUDRON_TOKEN=... publishing/deploy.sh
+#
+# Env:
+#   CLOUDRON_TOKEN   (required) Cloudron API token
+#   CLOUDRON_SERVER  default my.inference.coop
+#   SURFER_APP       default inference.coop (the Surfer app's location)
+#   SITE_DIR         default <repo>/.site-build
+
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SITE_DIR="${SITE_DIR:-$REPO_DIR/.site-build}"
+SERVER="${CLOUDRON_SERVER:-my.inference.coop}"
+APP="${SURFER_APP:-inference.coop}"
+DEST_SITE="${DOCS_DEST_SITE:-/app/data/public-docs}"   # docs.inference.coop
+DEST_PATH="${DOCS_DEST_PATH:-/app/data/public/docs}"   # inference.coop/docs/
+
+CLOUDRON_BIN="${CLOUDRON_BIN:-$(command -v cloudron || true)}"
+if [ -z "$CLOUDRON_BIN" ] && [ -x "$HOME/.local/bin/cloudron" ]; then
+  CLOUDRON_BIN="$HOME/.local/bin/cloudron"
+fi
+: "${CLOUDRON_BIN:?cloudron CLI not found (set CLOUDRON_BIN or add it to PATH)}"
+
+# The cloudron CLI is a node script (`#!/usr/bin/env node`); under systemd the
+# PATH may not contain the host's node, so look in the usual places.
+if ! command -v node >/dev/null 2>&1; then
+  for dir in "$HOME"/.hermes/tools/node*/bin /usr/local/bin; do
+    if [ -x "$dir/node" ]; then export PATH="$dir:$PATH"; break; fi
+  done
+fi
+
+: "${CLOUDRON_TOKEN:?CLOUDRON_TOKEN is required (the Cloudron API token)}"
+
+if [ ! -f "$SITE_DIR/index.html" ]; then
+  echo "No build found at $SITE_DIR — run publishing/build.sh first." >&2
+  exit 1
+fi
+
+# Build metadata: written into the output so a deploy can be verified from the
+# served site itself (which push produced it, and when).
+COMMIT="$(git -C "$REPO_DIR" rev-parse HEAD 2>/dev/null || echo unknown)"
+COMMIT_SHORT="$(git -C "$REPO_DIR" rev-parse --short HEAD 2>/dev/null || echo unknown)"
+BUILT_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+cat > "$SITE_DIR/meta.json" <<EOF
+{
+  "commit": "$COMMIT",
+  "commit_short": "$COMMIT_SHORT",
+  "built_at": "$BUILT_AT",
+  "generator": "mkdocs-material (publishing/build.sh)",
+  "source": "https://git.inference.coop/co-op/docs"
+}
+EOF
+
+echo "Deploying $SITE_DIR (commit $COMMIT_SHORT) -> $SERVER:$APP"
+echo "  $DEST_SITE  (docs.inference.coop)"
+echo "  $DEST_PATH  (inference.coop/docs/)"
+
+tar cf - -C "$SITE_DIR" . | \
+  "$CLOUDRON_BIN" --server "$SERVER" --token "$CLOUDRON_TOKEN" exec --app "$APP" -- \
+    sh -c "set -e
+           cat > /tmp/docs-site.tar
+           rm -rf '$DEST_SITE' && mkdir -p '$DEST_SITE' && tar xf /tmp/docs-site.tar -C '$DEST_SITE'
+           rm -rf '$DEST_PATH' && mkdir -p '$DEST_PATH' && tar xf /tmp/docs-site.tar -C '$DEST_PATH'
+           rm -f /tmp/docs-site.tar"
+
+echo "Done:"
+echo "  https://docs.inference.coop/"
+echo "  https://inference.coop/docs/"