Add Gitea Actions CI and release workflows and deployment assets

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -39,6 +39,40 @@ bamboo -hammerhead https://hammerhead.example.com -token <site token> -docker
 Open the edge's WireGuard UDP port (and any ports you open) in its firewall. Bamboo needs no inbound
 ports. Then open ports on the **Resources** page.
 
+## Deploying
+
+Releases are built by Gitea Actions. Pushing a tag such as `v0.2.0` runs `.gitea/workflows/release.yml`, which tests the code, builds Hammerhead for Linux (amd64, arm64, armv7), Windows (amd64) and macOS (amd64, arm64), publishes the archives with a `SHA256SUMS` file on the Releases page, and pushes a multi-architecture container image to this server's registry (`git.veillax.com/veillax/hammerhead`). Every push and pull request runs `.gitea/workflows/ci.yml`: formatting, vet, tests, and a check that every release platform still compiles.
+
+**On a Linux server (systemd)**
+
+```
+curl -LO https://git.veillax.com/Veillax/hammerhead/releases/download/v0.1.0/hammerhead_v0.1.0_linux_amd64.tar.gz
+curl -LO https://git.veillax.com/Veillax/hammerhead/releases/download/v0.1.0/SHA256SUMS
+sha256sum -c --ignore-missing SHA256SUMS
+tar xzf hammerhead_v0.1.0_linux_amd64.tar.gz && cd hammerhead_v0.1.0_linux_amd64
+sudo ./install.sh                 # installs the binary and a hardened systemd service
+sudoedit /etc/hammerhead/hammerhead.env   # your settings and secrets
+sudo systemctl start hammerhead
+```
+
+Use `linux_arm64` or `linux_arm` for Raspberry Pi and other ARM machines. To upgrade, repeat the same steps: your settings and data are kept. `sudo ./install.sh --uninstall` removes the service and binary but leaves `/etc/hammerhead` and `/var/lib/hammerhead` alone. `hammerhead -version` tells you which build is running.
+
+**With Docker**
+
+```
+cp .env.example .env              # fill it in
+docker compose -f deploy/docker-compose.yml up -d
+```
+
+The image is `git.veillax.com/veillax/hammerhead:<version>` (and `:latest` for full releases). The compose file is in the repository and inside each Linux archive.
+
+**Setting up the build (once)**
+
+- A Gitea Actions runner with the label `ubuntu-latest`, and Docker on it if you want the container image.
+- Nothing else is required: the workflows use the automatic job token. If your server doesn't let that token publish releases or packages, add the secrets `RELEASE_TOKEN` and `REGISTRY_TOKEN` (access tokens with release and package write permission) and optionally the variable `REGISTRY_USER`.
+- To skip the container image, set the repository variable `PUBLISH_DOCKER` to `false`.
+- Build locally with `sh deploy/build.sh` (archives in `dist/`).
+
 ## Configuration and secrets
 
 All three programs read a `.env` file from their working directory before they start (or the file