feat: Add CI/CD pipeline with Gitea Actions

- ci.yaml: Backend build+test, Frontend type-check+build, Security scan
- deploy.yaml: Manual deploy with health check + smoke test
- Deploy supports per-service deploy and --no-cache option

.gitea/workflows/ci.yaml

@@ -0,0 +1,73 @@
+name: CI - Build & Test
+run-name: 🔍 CI ${{ gitea.ref_name }} by @${{ gitea.actor }}
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  # ─── Backend ───────────────────────────────────
+  backend:
+    name: Backend (.NET)
+    runs-on: linux
+    container:
+      image: mcr.microsoft.com/dotnet/sdk:10.0
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Restore
+        run: dotnet restore backend/Nexus.Api.csproj
+
+      - name: Build
+        run: dotnet build backend/Nexus.Api.csproj --no-restore --configuration Release
+
+      - name: Test
+        run: dotnet test backend-tests/Nexus.Api.Tests.csproj --no-build --configuration Release --verbosity normal
+        continue-on-error: true
+
+  # ─── Frontend ──────────────────────────────────
+  frontend:
+    name: Frontend (Vue/TS)
+    runs-on: linux
+    container:
+      image: node:24-alpine
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Setup pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@latest --activate
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: frontend
+
+      - name: Type check
+        run: pnpm exec vue-tsc --noEmit
+        working-directory: frontend
+
+      - name: Build
+        run: pnpm build
+        working-directory: frontend
+
+  # ─── Security ──────────────────────────────────
+  security:
+    name: Security Check
+    runs-on: linux
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Check for .env leaks
+        run: |
+          if grep -r "API_KEY\|SECRET\|PASSWORD\|TOKEN" --include="*.cs" --include="*.ts" --include="*.vue" backend/ frontend/src/ 2>/dev/null; then
+            echo "⚠️ Warning: Potential secrets in source code (review manually)"
+          else
+            echo "✅ No obvious secrets found"
+          fi

.gitea/workflows/deploy.yaml

@@ -0,0 +1,77 @@
+name: Deploy to Production
+run-name: 🚀 Deploy by @${{ gitea.actor }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      service:
+        description: 'Service to deploy (empty = all)'
+        required: false
+        default: ''
+        type: string
+      no_cache:
+        description: 'Disable build cache'
+        required: false
+        default: false
+        type: boolean
+
+jobs:
+  deploy:
+    name: Deploy Nexus
+    runs-on: deploy  # only on runners with 'deploy' label
+    steps:
+      - name: Checkout latest code
+        uses: actions/checkout@v3
+
+      - name: Sync to deploy path
+        run: |
+          rsync -a --delete \
+            --exclude='.git' \
+            --exclude='.env' \
+            --exclude='backend-tests/bin' \
+            --exclude='backend-tests/obj' \
+            --exclude='backend/bin' \
+            --exclude='backend/obj' \
+            --exclude='frontend/dist' \
+            --exclude='frontend/node_modules' \
+            ${{ gitea.workspace }}/ /workspace/nexus/
+
+      - name: Set up Docker Buildx
+        run: docker buildx create --use 2>/dev/null || true
+
+      - name: Build & Deploy
+        working-directory: /workspace/nexus
+        run: |
+          BUILD_ARGS=""
+          if [ "${{ inputs.no_cache }}" = "true" ]; then
+            BUILD_ARGS="--no-cache"
+          fi
+          
+          if [ -n "${{ inputs.service }}" ]; then
+            echo "🚀 Deploying service: ${{ inputs.service }}"
+            docker compose build $BUILD_ARGS ${{ inputs.service }}
+            docker compose up -d --force-recreate ${{ inputs.service }}
+          else
+            echo "🚀 Deploying all services"
+            docker compose build $BUILD_ARGS
+            docker compose up -d --force-recreate
+          fi
+
+      - name: Health Check
+        run: |
+          sleep 5
+          echo "🏥 Health check..."
+          curl -sf --max-time 10 https://nexus.noveria.net/health || echo "⚠️ Health check failed"
+          echo ""
+          docker compose -f /workspace/nexus/compose.yaml ps
+
+      - name: Verify (smoke test)
+        run: |
+          echo "🔍 Smoke test..."
+          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" https://nexus.noveria.net/dashboard)
+          echo "Dashboard: HTTP $HTTP_CODE"
+          if [ "$HTTP_CODE" != "200" ]; then
+            echo "❌ Dashboard not reachable!"
+            exit 1
+          fi
+          echo "✅ Deployment verified"