Add a weekly Renovate workflow for dependency updates

Runs renovate/renovate against this Gitea instance on the native
deploy runner, opening PRs for outdated Bundler dependencies instead
of relying on manually noticing (as happened with puma/mustermann
earlier).

.gitea/workflows/renovate.yml

@@ -0,0 +1,24 @@
+name: Renovate
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Gitea extends standard cron syntax with an optional "TZ=" prefix.
+    - cron: "TZ=Europe/Bratislava 0 6 * * 1"
+
+jobs:
+  renovate:
+    # The native deploy runner (see docs/deployment.adoc) already has
+    # Docker access — Renovate itself is a one-shot batch job, not a
+    # long-running service, so `docker run`, not docker-compose.
+    runs-on: deploy
+    steps:
+      - name: Run Renovate
+        run: |
+          docker run --rm \
+            -e RENOVATE_PLATFORM=gitea \
+            -e RENOVATE_ENDPOINT="${{ gitea.server_url }}/api/v1/" \
+            -e RENOVATE_TOKEN="${{ secrets.RENOVATE_TOKEN }}" \
+            -e RENOVATE_REPOSITORIES="${{ gitea.repository }}" \
+            -e RENOVATE_ONBOARDING=false \
+            renovate/renovate

docs/development.adoc

@@ -98,3 +98,17 @@ Gitea Actions runner: `ruby -c` on every `.rb` file, a `require_relative
 "app"` smoke check that the app loads without error, and `node --check`
 on every file under `public/js/`. There is no test suite yet — these
 are cheap syntax/load checks, not behavioral tests.
+
+`.gitea/workflows/renovate.yml` runs
+https://docs.renovatebot.com[Renovate] (the `renovate/renovate` image)
+weekly (Mondays, also triggerable manually), opening PRs for outdated
+dependencies (Bundler `Gemfile`/`Gemfile.lock`, auto-detected — no
+`renovate.json` needed) against this Gitea instance
+(`RENOVATE_PLATFORM=gitea`). It runs on the native `deploy` runner (see
+`docs/deployment.adoc`) as a one-shot `docker run`, not a persistent
+service. Needs a `RENOVATE_TOKEN` repo secret — a Gitea personal
+access token (*Settings → Applications → Generate New Token*, with
+repository read/write scope) from whichever account should author the
+PRs; `RENOVATE_ONBOARDING=false` skips Renovate's usual first-PR
+"configure me" step and goes straight to dependency update PRs using
+its defaults.