feat: add Gitea CI workflow and production Containerfile

Bake source into the image (COPY src/) so production containers
run without volume mounts. CI pipeline runs ruff + pytest then
builds and pushes harbor.mymx.me/s5p/s5p:latest on push to main.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -0,0 +1,31 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: python:3.13-slim
+    steps:
+      - uses: actions/checkout@v4
+      - run: pip install pyyaml ruff pytest
+      - run: ruff check src/ tests/
+      - run: PYTHONPATH=src pytest tests/ -v
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          docker login harbor.mymx.me \
+            -u "${{ secrets.HARBOR_USER }}" \
+            -p "${{ secrets.HARBOR_PASS }}"
+      - run: |
+          docker build \
+            -t harbor.mymx.me/s5p/s5p:latest \
+            -f Containerfile .
+      - run: docker push harbor.mymx.me/s5p/s5p:latest