ci: add publish workflow with frontend and backend deploy

publish.yml — triggered on push to main, two parallel jobs:

frontend:
- Builds Vite frontend (fnm + npm ci + npm run build)
- Rsyncs dist/ to gitea_ci@UI_HOST:UI_PATH/
- Rsyncs nginx config to UI_HOST, creates sites-enabled symlink,
  runs nginx -t && systemctl reload nginx

backend:
- Builds release binary (cargo build --release -p ericrfb-proxy)
- Stops blekin.service on WS_HOST
- Rsyncs binary to WS_HOST:/usr/local/bin/ericrfb-proxy via sudo rsync
- Rsyncs systemd unit to WS_HOST:/etc/systemd/system/blekin.service
- Enables and starts the service

asset/nginx/blekin.kosherinata.internal.conf:
- Serves static frontend from UI_PATH
- Reverse proxies /api/ to frootmig:3000 with WebSocket upgrade
- 24h read/send timeouts for long-lived KVM sessions

asset/systemd/blekin.service:
- Runs ericrfb-proxy with BLEKIN_HOST=10.3.0.130
- Restart on failure with 5s backoff

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

asset/systemd/blekin.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=blekin e-RIC RFB to HTML5 KVM proxy
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/ericrfb-proxy
+WorkingDirectory=/var/lib/blekin
+Environment=RUST_LOG=ericrfb_proxy=info
+Environment=BLEKIN_HOST=10.3.0.130
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target