deploy: Docker compose + entrypoint (pull-loop autosync), Nix revert script, .env (gitignored) for Gitea deploy token

deploy/kontra.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Kontra — GOTH news-opinion site
+After=network.target
+
+[Service]
+Type=simple
+User=sam
+Group=users
+WorkingDirectory=/var/www/kontra_day
+Environment=KONTRA_CONTENT=/var/www/kontra_day/content
+Environment=KONTRA_MEDIA=/media
+Environment=PORT=8600
+# Binds :8600 (localhost-adjacent; .13 Caddy vhost reverse_proxies to it).
+ExecStart=/var/www/kontra_day/bin/kontra-bin
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target