ci: add Gitea Actions workflow for checks and image publish

Two jobs:
- checks: runs on every push/PR - lint, tsc --noEmit, and a full
  `pnpm build` as the static-check gate.
- publish: only on a tag push, gated on checks passing first. Builds
  the Dockerfile and pushes to this instance's container registry
  (dev.pivoine.art/<owner>/<repo>) tagged both `latest` and the exact
  git tag, using PACKAGE_TOKEN from the runner's own environment to
  log in (not a repo secret, per how it's configured on this runner).

.gitea/workflows/ci.yml

@@ -0,0 +1,63 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  checks:
+    name: Static checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Enable corepack
+        run: corepack enable
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Type check
+        run: pnpm exec tsc --noEmit
+
+      - name: Build
+        run: pnpm build
+
+  publish:
+    name: Build and push image
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # PACKAGE_TOKEN is provided by the runner environment, not a repo
+      # secret - it's already present in the job's shell environment.
+      - name: Log in to the Gitea container registry
+        run: echo "$PACKAGE_TOKEN" | docker login dev.pivoine.art -u ${{ github.repository_owner }} --password-stdin
+
+      - name: Build image
+        run: |
+          docker build \
+            -t dev.pivoine.art/${{ github.repository }}:latest \
+            -t dev.pivoine.art/${{ github.repository }}:${{ github.ref_name }} \
+            .
+
+      - name: Push image
+        run: |
+          docker push dev.pivoine.art/${{ github.repository }}:latest
+          docker push dev.pivoine.art/${{ github.repository }}:${{ github.ref_name }}
+
+      - name: Log out
+        if: always()
+        run: docker logout dev.pivoine.art