deploy: Docker compose + entrypoint (pull-loop autosync), Nix revert script, .env (gitignored) for Gitea deploy token

deploy/docker/Dockerfile

@@ -0,0 +1,27 @@
+# Kontra — GOTH news-opinion site. Self-contained container.
+# Build context = /home/sam/Docker/Containers/kontra (has src/{go.mod,go.sum,src/...})
+FROM golang:1.26-bookworm AS build
+# templ CLI for codegen (generates *_templ.go before build)
+RUN go install github.com/a-h/templ/cmd/templ@v0.3.1020
+ENV PATH="/root/go/bin:${PATH}"
+WORKDIR /src
+COPY src/go.mod src/go.sum ./
+RUN go mod download
+COPY src/src/ ./src/
+WORKDIR /src/src
+RUN templ generate
+RUN go build -trimpath -ldflags="-s -w" -o /kontra-bin .
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates git openssh-client bash \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY --from=build /kontra-bin /usr/local/bin/kontra-bin
+
+# entrypoint (pull loop + webserver) from runtime mount
+COPY entrypoint.sh /usr/local/bin/kontra-entrypoint
+RUN chmod +x /usr/local/bin/kontra-entrypoint
+
+EXPOSE 8600
+ENTRYPOINT ["/usr/local/bin/kontra-entrypoint", "kontra-bin", "8600"]