Move check/renovate onto brick-build, deploy stays brick-host

Renovate no longer needs Docker access for a one-shot docker-run job:
switched to setup-node + npm install -g renovate (matching labelprint's
workflow), so it fits the same brick-build runner as check instead of
the stale "deploy" label. Also note down the build-log readability/API
gaps flagged from a real failed terrain build.

.gitea/workflows/ci.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: brick-build
     steps:
       - uses: actions/checkout@v4
 

.gitea/workflows/renovate.yml

@@ -8,17 +8,22 @@ on:
 
 jobs:
   renovate:
-    # The native deploy runner (see docs/deployment.adoc) already has
-    # Docker access — Renovate itself is a one-shot batch job, not a
-    # long-running service, so `docker run`, not docker-compose.
-    runs-on: deploy
+    runs-on: brick-build
     steps:
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install Renovate
+        run: npm install -g renovate
+
       - name: Run Renovate
-        run: |
-          docker run --rm \
-            -e RENOVATE_PLATFORM=gitea \
-            -e RENOVATE_ENDPOINT="${{ gitea.server_url }}/api/v1/" \
-            -e RENOVATE_TOKEN="${{ secrets.RENOVATE_TOKEN }}" \
-            -e RENOVATE_REPOSITORIES="${{ gitea.repository }}" \
-            -e RENOVATE_ONBOARDING=false \
-            renovate/renovate
+        run: renovate
+        env:
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: "${{ gitea.server_url }}/api/v1/"
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_REPOSITORIES: "${{ gitea.repository }}"
+          RENOVATE_ONBOARDING: "false"
+          GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}

TODO.adoc

@@ -71,3 +71,12 @@ Deprioritized for now — revisit after the sections above land.
 * [ ] Level gauge from IMU (ESP32/RPi) — camper tilt, wheel-chock leveling calculation
 * [ ] Victron/Home Assistant via MQTT or WebSocket — battery SoC, tank levels, temperatures
 * [ ] Plot GPS track with historical battery/speed data
+
+== Admin / ops tooling
+
+* [ ] Offline build log readability — a failed pmtiles/terrain build currently surfaces as one
+  ~500k-character line; format it for the web UI instead (e.g. per-country/state name + status,
+  not the raw combined stdout/stderr dump)
+* [ ] Expose the build log via an API endpoint, not just embedded in the admin page
+* [ ] Document all API endpoints somewhere and make them easy to browse (status of each) —
+  maybe a status page, login-gated

docs/deployment.adoc

@@ -7,9 +7,9 @@ MapTool deploys as a Podman container (via `podman compose`, driven by a
 the Gitea Actions runners run on. Two separate runners are registered
 against the Gitea instance:
 
-* The existing Docker-based runner (`gitea/runner:3`), labels
-  `ubuntu-latest`/`ubuntu-24.04`/`ubuntu-22.04` — runs the `check` job
-  in a fresh, isolated container per job, same as before.
+* The existing Docker-based runner (`gitea/runner:3`), label
+  `brick-build` — runs the `check` and `renovate` jobs in a fresh,
+  isolated container per job, same as before.
 * A dedicated native runner, installed directly on the host (no Docker
   around it), label `brick-host` — runs only the `deploy` job.