Add CI workflow: test, build, and auto-deploy /weather on push to master

Deploys dist/index.html to the WebDAV mirror via basic-auth curl PUT from
WEBDAV_USER/WEBDAV_PASS repo secrets, then verifies the deployed bytes
match the local build. Hard-fails if the secrets are missing so a silent
non-deploy can never look like a success.

.gitea/workflows/deploy.yml

@@ -0,0 +1,92 @@
+name: Test, Build & Deploy
+
+# Tests + build run on every push/PR; the deploy (WebDAV publish of the
+# single-file dist/index.html) runs only on the default branch (master).
+"on":
+  push:
+    branches:
+      - '**'
+  pull_request:
+
+jobs:
+  test-and-build:
+    runs-on: host
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm run test:run
+
+      - name: Build (single-file bundle)
+        run: npm run build
+
+      - name: Verify build output
+        run: test -f dist/index.html
+
+  deploy:
+    # Release the built app only when a commit lands on the default branch.
+    needs: test-and-build
+    if: github.ref == 'refs/heads/master'
+    runs-on: host
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build (single-file bundle)
+        run: npm run build
+
+      - name: Verify build output
+        run: test -f dist/index.html
+
+      # Publish dist/index.html to the WebDAV mirror. The pretty URL
+      # (…/weather/index.html) 401s without auth; the file is the full
+      # www/static/weather/index.html path with basic auth.
+      - name: Publish to WebDAV (/weather)
+        env:
+          WEBDAV_USER: ${{ secrets.WEBDAV_USER }}
+          WEBDAV_PASS: ${{ secrets.WEBDAV_PASS }}
+          WEBDAV_URL: https://files.thecookiejar.me/www/static/weather/index.html
+        run: |
+          if [ -z "$WEBDAV_USER" ] || [ -z "$WEBDAV_PASS" ]; then
+            echo "::error::WEBDAV_USER / WEBDAV_PASS repo secrets are not set."
+            echo "::error::Add them under Settings → Actions → Secrets, then re-run this job."
+            exit 1
+          fi
+          curl -sS --fail \
+            -u "$WEBDAV_USER:$WEBDAV_PASS" \
+            -X PUT -T dist/index.html \
+            -H 'Content-Type: text/html' \
+            "$WEBDAV_URL"
+          echo "Published to $WEBDAV_URL"
+
+      # Pull the freshly uploaded file back and compare it to our build, so a
+      # successful deploy isn't just "curl returned 0" but bytes actually match.
+      - name: Verify deployed file matches build
+        env:
+          WEBDAV_USER: ${{ secrets.WEBDAV_USER }}
+          WEBDAV_PASS: ${{ secrets.WEBDAV_PASS }}
+          WEBDAV_URL: https://files.thecookiejar.me/www/static/weather/index.html
+        run: |
+          curl -sS --fail -u "$WEBDAV_USER:$WEBDAV_PASS" "$WEBDAV_URL" -o /tmp/deployed.html
+          sha1sum dist/index.html /tmp/deployed.html
+          test "$(sha1sum dist/index.html | cut -d' ' -f1)" = \
+               "$(sha1sum /tmp/deployed.html | cut -d' ' -f1)" \
+            && echo "Deploy verified: bytes match" \
+            || { echo "::error::Deployed file does not match build"; exit 1; }