docs site: add MkDocs publishing layer (build, deploy, push-to-main webhook)

Renders the repository's Markdown (which stays where it is) into a
member-readable static site with Material for MkDocs: co-op brand colours
and logo, self-hosted OFL Figtree, offline search, no external hosts.

- publishing/build.sh   stage .site-src, render .site-build (mkdocs --strict)
- publishing/deploy.sh  write the build into the Surfer app container
- publishing/webhook-receiver.py + .service   Gitea push hook on main
                        triggers pull -> build -> deploy (agent host, no new
                        Cloudron app)

mkdocs.yml

@@ -0,0 +1,118 @@
+# MkDocs configuration for the member-readable documentation site.
+#
+# The documentation source stays exactly where it is — Markdown files at the
+# repository root (plus maintenance/ and incidents/). This is a *publishing*
+# layer over that source, not an edit of it. docs_dir is the repo root, so no
+# document has to move for the generator to find it.
+#
+# Build:  see publishing/build.sh
+# Deploy: see publishing/deploy.sh
+#
+# Constraints baked in here:
+#   * theme.font: false  -> Material must NOT pull Google Fonts.
+#   * fonts are self-hosted (publishing/fonts/) and OFL-licensed (Figtree).
+#   * no CDN / third-party host appears anywhere in the output.
+
+site_name: Inference Cooperative
+site_description: >-
+  Member-readable documentation for the Inference Cooperative: how to join and
+  use the service, the model catalogue, API access, governance and policies.
+site_url: https://docs.inference.coop/
+# MkDocs requires the docs directory to be a *child* of the config's directory
+# and refuses to read the repository root directly. So the build stages the
+# Markdown into .site-src/ (a generated, gitignored mirror of the documents)
+# and renders that. No document is moved or rewritten in the repository — the
+# staging copy exists only during the build.
+docs_dir: .site-src
+# Build output.
+site_dir: .site-build
+use_directory_urls: true
+
+theme:
+  name: material
+  language: en
+  # Disable the theme's built-in Google Fonts loader. Without this, Material
+  # requests Roboto from fonts.googleapis.com / fonts.gstatic.com.
+  font: false
+  logo: publishing/logo.svg
+  favicon: publishing/logo.svg
+  palette:
+    # Light is listed first, so a fresh visitor gets the bright theme.
+    - media: "(prefers-color-scheme: light)"
+      scheme: default
+      primary: teal
+      accent: deep orange
+      toggle:
+        icon: material/weather-night
+        name: Switch to dark mode
+    - media: "(prefers-color-scheme: dark)"
+      scheme: slate
+      primary: teal
+      accent: deep orange
+      toggle:
+        icon: material/weather-sunny
+        name: Switch to light mode
+  features:
+    - navigation.tabs
+    - navigation.sections
+    - navigation.top
+    - navigation.indexes
+    - search.suggest
+    - search.highlight
+    - content.code.copy
+    - toc.integrate
+
+nav:
+  - Home: README.md
+  - Getting started: getting-started.md
+  - Models: models.md
+  - API access: api-access.md
+  - Energy & carbon: energy.md
+  - Infrastructure: infrastructure.md
+  - Background: background.md
+  - Governance:
+      - Charter: charter.md
+      - Code of conduct: code-of-conduct.md
+      - Open questions: open-questions.md
+      - Terms of Service: terms-of-service.md
+      - Privacy Policy: privacy-policy.md
+  - Operator runbook: operator-token-runbook.md
+  - Maintenance:
+      - Chat task models: maintenance/chat-task-models.md
+      - LibreChat sandbox: maintenance/librechat-sandbox.md
+  - Incidents:
+      - 2026-10-02 gateway CVE upgrade: incidents/2026-10-02-gateway-cve-upgrade.md
+
+plugins:
+  # Built-in, offline search — the index is a JSON file in the build output.
+  - search
+
+markdown_extensions:
+  - admonition
+  - attr_list
+  - md_in_html
+  - tables
+  - toc:
+      permalink: true
+  - pymdownx.details
+  - pymdownx.superfences
+  - pymdownx.tasklist:
+      custom_checkbox: true
+
+extra_css:
+  # Co-op brand: palette from the website + self-hosted Figtree (SIL OFL 1.1).
+  - publishing/brand.css
+
+# Keep build/tooling files out of the rendered site.
+exclude_docs: |
+  .git/
+  *.sh
+  publishing/README.md
+  publishing/requirements.txt
+
+# Links to git.inference.coop (e.g. code-of-conduct.md in charter.md) are
+# intentional absolute URLs; do not warn about them.
+validation:
+  links:
+    absolute_links: ignore
+    unrecognized_links: ignore