feat: prerender every route + Gitea Actions deploy

Make the site fully prerendered so a plain curl returns complete content
for every route (crawlers / AI screening tools see real text, not an empty
#root), while humans keep full client interactivity.

Prerender:
- Build-time per-route render: prefetch data, renderToString, inline the
  dehydrated react-query cache as window.__RQ_STATE__; client hydrateRoots
  and refetches live (activity stays fresh; crawlers get the baked snapshot).
- New entry-server.tsx + prerender/{prefetch,routes,meta}.ts + run-prerender.mjs;
  shared lib/ranges.ts keeps SSR and client query keys identical.
- pnpm build now: tsc -b -> vite client build -> ssr build -> prerender.
- API base absolute at build (VITE_API_BASE), relative /api/v1 in the browser.
- CSS imports moved to the client entry so the tree imports under Node.
- schema.org Person + Occupation JSON-LD and per-route title/description/og.
- UTC + explicit field widths on shared date formatting so SSR and client
  hydration match byte-for-byte (fixes hydration mismatch on /activity).
- Strip non-text gist content from the CV fetch (1MB -> 25KB gzipped page).

Deploy (Gitea Actions, replaces script/deploy.sh):
- deploy.yml: on push to main, lint/test gate, build api+worker as static
  musl binaries (pure-rustls, no glibc skew) + prerendered web, deploy each
  over SSH as gitea_ci with scoped sudo.
- refresh.yml: daily cron re-bakes only the web snapshot so gist/activity
  edits propagate without a push or bouncing the api/worker.
- script/infra-setup.sh + asset/sudoers.d/{api,worker,web}-host.conf for
  one-time per-host provisioning. Secrets: RSYNC_SSH_KEY, QUERY_GITHUB_TOKEN,
  QUERY_GITEA_TOKEN.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7zF7Kf4JqDwa6M8Qgge9M

CLAUDE.md

@@ -62,9 +62,19 @@ cd ui
 pnpm install                         # install deps
 pnpm dev                             # dev server on :5173 (proxies /api/* to localhost:8080)
 pnpm lint                            # tsc --noEmit type-check
-pnpm build                           # production build (tsc -b && vite build)
+pnpm build                           # production build: client bundle, then prerender
 ```
 
+The build is three steps (see `ui/package.json`): `tsc -b` → `vite build` (client
+SPA) → `pnpm run prerender` (an SSR build of `src/entry-server.tsx`, driven by
+`run-prerender.mjs`, that bakes one static `index.html` per route into `ui/dist/`).
+The prerender fetches data at build time from `VITE_API_BASE` (default
+`https://rob.tn/api/v1`) and inlines the dehydrated react-query cache as
+`window.__RQ_STATE__`; the client hydrates it and refetches live. So a plain
+`curl` of any route returns full content (for crawlers / AI screeners), while the
+browser keeps full interactivity. Date formatting in the shared tree is pinned to
+UTC + explicit field widths so SSR and client hydration match byte-for-byte.
+
 ## Database
 
 PostgreSQL with three migrations in `crates/moments-data/migrations/`. Two roles: `moments_rw` (worker, full access) and `moments_ro` (API, SELECT-only).
@@ -77,4 +87,26 @@ Blog posts are markdown files with YAML frontmatter (`title`, `slug`, `date`; op
 
 ## Deployment
 
-Production uses `./script/deploy.sh`. Services run under systemd with hardened units. Secrets resolved from `pass` store via template substitution. Nginx reverse-proxies `/api/` to the API host.
+CI-driven via **Gitea Actions** (`.gitea/workflows/`), the source of infra truth
+(hosts/ports/paths live in the workflow `env`, not a manifest):
+
+- `deploy.yml` — on push to `main` (or manual dispatch): lint/test gate, build the
+  api + worker as static musl binaries (pure-rustls, so no glibc skew) and the
+  prerendered web bundle, then deploy each component over SSH as the `gitea_ci`
+  user with scoped sudo (`asset/sudoers.d/`). Services run under systemd with
+  hardened units; the api/worker reach postgres over mTLS using the host cert.
+- `refresh.yml` — daily `schedule:` (+ manual): rebuilds and redeploys only the
+  web tier, re-baking the prerendered crawler snapshot from the current gist (CV)
+  and activity API without bouncing the api/worker.
+
+One-time per-host provisioning (the `gitea_ci` user, its `authorized_keys`, the
+scoped sudoers drop-in) is `script/infra-setup.sh`, run once per host by an
+operator. Gitea repo secrets: `RSYNC_SSH_KEY`, `QUERY_GITHUB_TOKEN`,
+`QUERY_GITEA_TOKEN` (the bare `GITHUB_TOKEN`/`GITEA_TOKEN` names are reserved by
+Actions, so the worker poller's tokens use the `QUERY_` prefix).
+Nginx reverse-proxies `/api/` to the API host and serves the per-route static
+files via `try_files $uri $uri/ /index.html`.
+
+`./script/deploy.sh` is the legacy operator-driven path (workstation + `pass`);
+it still works and the Gitea workflow supersedes it. Remove it once the workflow
+is validated on the live hosts.