Add Docker deployment via Gitea Actions host-mode runner

Containerize the app (Dockerfile, docker-compose.yaml) and add a CI
deploy job that syncs the checkout to /srv/docker/maptool and runs
docker compose directly, using the runner's new "host" execution
label to reach the host's Docker daemon and filesystem.

.gitea/workflows/ci.yml

@@ -29,3 +29,39 @@ jobs:
 
       - name: JS syntax check
         run: find public/js -name "*.js" -print0 | xargs -0 -n1 node --check
+
+  # Runs directly in the runner's own container (see the "host" label in the
+  # runner's config.yaml), not in an ephemeral per-job container — that's
+  # what gives this job access to /var/run/docker.sock (already mounted into
+  # the runner container) and to /srv/docker (bind-mounted there too, see
+  # docs/deployment.adoc). No systemd/sudo involved.
+  deploy:
+    needs: check
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: host
+    steps:
+      - uses: actions/checkout@v4
+
+      # /srv/docker/maptool is the same path inside the runner container and
+      # on the real host (1:1 bind mount) — required so the relative bind
+      # mount `./data:/app/data` in docker-compose.yaml resolves to the
+      # correct real host path when the daemon creates the container.
+      #
+      # No rsync in the runner image, so this clears out everything in the
+      # target except data/ (uploaded GPX files, offline.pmtiles — never
+      # part of the git checkout in the first place, since it's gitignored)
+      # and copies the fresh checkout over, dropping .git afterwards.
+      - name: Sync to /srv/docker/maptool
+        run: |
+          mkdir -p /srv/docker/maptool
+          for f in /srv/docker/maptool/*; do
+            [ "$(basename "$f")" = "data" ] && continue
+            rm -rf "$f"
+          done
+          cp -a . /srv/docker/maptool/
+          rm -rf /srv/docker/maptool/.git
+
+      - name: Deploy
+        run: |
+          cd /srv/docker/maptool
+          docker compose -p maptool up --build -d