ci: QA suite (repo+live), Gitea Actions workflow, app config-as-code

- qa/site-qa.sh: repo structure/link checks + full live crawl (routes,
  links, assets, canonical-https)
- .gitea/workflows/qa.yml: repo QA on push, nightly live QA
- app/: config-as-code for the deployed sync job, scheduler entry,
  and Grav system.yaml (reverse-proxy HTTPS detection)
- local pre-push hook runs repo QA

https://projects.knownelement.com/issues/928

README.md

@@ -0,0 +1,16 @@
+
+## QA / CI / deployment process
+
+- `qa/site-qa.sh` — repo checks (structure, frontmatter, internal link targets).
+  Run before every push; also enforced by the local pre-push hook.
+- `.gitea/workflows/qa.yml` — Gitea Actions: repo QA on every push, nightly
+  live QA (full route crawl + link/asset check + HTTPS-canonical check).
+- Deployment: the site container runs `app/git-sync-job.sh` (config-as-code
+  copy here) every 15 minutes via the Grav scheduler
+  (`app/scheduler/git-sync.job.yaml`): pulls upstream, clears the Grav cache,
+  verifies `/` and `/shop` answer 200 — **rolls back to the previous commit
+  automatically if verification fails** — and pushes local content edits
+  (authored VpEngOps).
+- Site management: edit here (gitea web UI works fine) and the site follows
+  within 15 minutes. There is no /admin UI: Grav 2 ships without one and this
+  deployment is git-first by design.