feat(delivery): phase 12 — the container, and the defect only a proxy could find

PLAN.md §13 phase 12, the last one. Four decisions of record, D54–D57, taking the
count to fifty-seven; recorded in §6, "How phase 12 delivered it".

A two-stage Dockerfile, a pull-only docker-compose.yml carrying both bind mounts,
.env.example, the workflow that publishes and deploys, CONTRIBUTING.md, the
community-health files this was the only repository of the ten to lack, and
DEPLOY.md.

D54 — a merge deploys, amending D6. build-image.yml pushes
runicgateway-site:latest and :sha-<7>, then rolls the container over on the
`rgcom` runner out of /opt/runicgateway.com, and waits for the container's own
healthcheck rather than for `up -d` to return.

D55 — the site runs on its own host behind a generic reverse proxy, so DEPLOY.md
states the four requirements rather than one worked example, and the container
binds 127.0.0.1 so the safe configuration is the default.

D56 — @astrojs/node derives the request protocol from req.socket.encrypted and
never reads x-forwarded-proto, so behind a TLS-terminating proxy the browser sends
Origin: https://… while the container computes http://… and Astro's CSRF check
compares them for equality. Every beta signup, from every visitor, was answered
403. serve.mjs now normalises both forwarded headers, unconditionally — the image
should deploy and work. Two assertions in test/headers.test.mjs hold both halves.

D57 — DEPLOY.md rather than a README section; SECURITY.md and CODE_OF_CONDUCT.md
are pointers to the org's copies rather than copies, because a copy would hard-code
the contact address D13 confines to brand.json.

Verified: npm run verify green (eleven checks, 36 unit tests, 7 served tests,
astro check 0 errors). The image was built and run with both mounts — a mounted
brand reached 51 files and all 50 search pages, /brand/* fell back per file, a
proxy-shaped signup reached the store, and the export CLI wrote both Play files to
the host mount. docker compose config caught a YAML trap in the healthcheck: a
block sequence reads the `: ` in `r.ok ? 0 : 1` as a mapping.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,48 @@
+---
+name: Bug report
+about: Something on the site is broken, wrong, or behaving unexpectedly
+title: "[bug] "
+labels:
+  - bug
+---
+
+## Summary
+
+<!-- A clear, concise description of the problem. -->
+
+## Where
+
+<!-- The URL, or the page and the section. If it is a documentation page, the heading. -->
+
+- Page:
+- Viewport width, if it is a layout problem:
+- Browser and version:
+
+## What happened, and what you expected
+
+<!--
+  Include exact wording for a factual error, and the console message if there is
+  one. A screenshot helps for anything visual.
+-->
+
+## Is it a factual error?
+
+<!--
+  The most valuable reports this repository gets are claims that are WRONG about
+  the platform — a version, a command, a flag, a capability that no longer works
+  that way. If so, say where the correct answer lives (which repository, which
+  file), because the fix is usually to a data file or a check rather than to the
+  sentence.
+-->
+
+## Additional context
+
+<!-- Anything else that helps. -->
+
+<!--
+  Security issue? Do NOT file it here — see SECURITY.md for the private route.
+
+  A problem with the PLATFORM rather than with this site (the website, the
+  sidecar, the shard plugin, the installer, the Android app) belongs in that
+  repository's tracker. This one only describes them.
+-->

.gitea/ISSUE_TEMPLATE/config.yaml

@@ -0,0 +1,11 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://gitea.whitlocktech.com/RunicGateway/runicgateway.com/src/branch/main/SECURITY.md
+    about: Please do not open a public issue for security problems — report them privately instead (see SECURITY.md).
+  - name: Questions, help and the Android beta
+    url: https://discord.gg/t2Jav8yT4g
+    about: Discord is the front door — instant, and it needs no account here. Bug reports are welcome there too.
+  - name: A problem with the platform, not the site
+    url: https://gitea.whitlocktech.com/RunicGateway
+    about: The website, the sidecar, the shard plugin, the installer and the Android app each have their own tracker. This repository only describes them.

.gitea/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,38 @@
+---
+name: Feature request
+about: Suggest a page, a section, or a change to how the site explains something
+title: "[feature] "
+labels:
+  - enhancement
+---
+
+## Problem / motivation
+
+<!--
+  What were you trying to find out, or do, when the site let you down? A missing
+  page is easier to judge from the question that went unanswered than from the
+  page title.
+-->
+
+## Proposed solution
+
+<!-- What you would like to see. -->
+
+## Does it belong here?
+
+<!--
+  Two boundaries this repository holds deliberately (PLAN.md §1):
+
+  - The site TEACHES; `docs/` SPECIFIES. Protocol, module API, backend design and
+    installer behaviour are normative in the docs repository — a page here links
+    out rather than restating them, so that it cannot drift.
+  - Absences are stated as data, not implied. If the request is for something the
+    platform does not do yet, it may belong in src/data/notBuilt.mjs rather than
+    as a page.
+
+  Say which side you think it falls on; being wrong about it is fine.
+-->
+
+## Additional context
+
+<!-- Mockups, links, related issues, the repository the change would describe. -->