feat: add a whole new site babyyy - #144

Editors sign in with Microsoft Entra ID, Google or any OpenID Connect
provider and edit a GitHub repository without a GitHub account. The
gateway answers who is signed in from a signed session and passes the
CMS's GitHub calls on as a GitHub App, after checking them against
default-deny rules for repository, branches, paths and GraphQL
mutations. No database and no runtime dependencies, so it runs on
Cloudflare Workers, Node, Deno and Bun. MIT licensed.

The Astro site that merges the main site, the blog and the journal moves
here from TrialAndErrorOrg/websites as a fresh copy. Its /admin sign-in
now uses sveltia-gateway from the workspace, limited to the branch and
folders the CMS edits. Underlay reads retry when rate limited.

site.yml builds it on GitHub Actions, keeping pnpm, turbo and the site's
image and article caches between runs, publishes
ghcr.io/trialanderrororg/site and calls Coolify's deploy webhook. The
Dockerfile only packages the build. CI type-checks the site but leaves
building it to site.yml, and oxfmt skips it because it can't read .astro
files. .env.example files are no longer ignored.

npm provenance checks a package's repository field against the repo the release comes from.

Pages, settings and uploads move to TrialAndErrorOrg/site-content, so saving in
/admin no longer adds commits here. The site reads it from a checkout next to
this repository, or CONTENT_DIR, and the CMS and its gateway now edit that
repository. site.yml checks it out.

dev and build run through varlock, which reads .env.schema and fills the tokens
from the 1Password Website vault: the desktop app locally, a service account in
CI, so OP_TOKEN is the only GitHub secret. Turbo passes the variables varlock
needs through to the site's tasks.

Mostly generated API docs and changelogs. GitHub redirects the old links, this
just saves the hop. No changeset: nothing published changes.

…ite access

Astro ignores X-Forwarded-* headers unless the domain is allowed, so behind
Coolify /admin would have sent Microsoft and the CMS http://localhost:4321.
site-content now starts site.yml with gh workflow run, which needs Actions
write instead of the Contents write a repository dispatch needs.

… tokens

The image starts through varlock run, so Coolify only needs OP_TOKEN and
ADMIN_AUTH. The schema points at the Website vault's real item names, and the
README lists what the Entra app needs.

editing, development, admin sign-in (with what the Entra app needs) and
deploying (with the Coolify setup). The image gets a health check that needs
no curl.

**/docs/* (for typedoc output) had kept them out of the previous commit. The
editing guide also says the sign-in button reads GitHub but opens Microsoft.

Sveltia names the button after its backend and has no setting for it, so the
admin page swaps the text when ADMIN_AUTH isn't github. auth_methods: [oauth]
hides Sign In Using Access Token.

GitHub leaves permissions out of GET /repos for an installation token, so
Sveltia said the editor had no access to the repository. The gateway now fills
them in: push is always true, and the rules refuse writes, read-only included.
The site's local test mode gets a random session secret when none is set.

Only what the server loads at runtime stays a dependency: Astro bundles itself
into dist/server, so astro and the build-only packages move to devDependencies
and pnpm deploy leaves them out. The image is Alpine now, with the musl builds
of sharp and varlock. CI smoke-tests every server-rendered route of the built
image before pushing it, so a runtime package left out fails there.

Posts, people and categories are content collections read from site-content
(BLOG_SOURCE=content, the default). Local images are resized at build like
remote ones. scripts/blog-to-content.ts exported them from Strapi: Word HTML
to Markdown, team members and guest authors merged with their old slugs kept,
images as WebP.

/admin gets Blog, People and Categories, saves drafts through the editorial
workflow (cms/** branches), turns uploads into WebP of at most 2400 pixels and
offers Unsplash, with the key from UNSPLASH_ACCESS_KEY. The blog source loads
lazily, so Strapi's preview routes don't pull in build-only packages.

…bel changes

The preview pane draws a post like the post page, with the site's CSS and
fonts, and follows along as the editor types. Images come from Sveltia, so new
uploads show before they're saved. The styles stay inside the blog preview, so
the other collections keep Sveltia's plain one.

The content integration's fs.allow replaced Vite's default, so dev refused to
serve the site's own client scripts. The monorepo root is listed again.

The date field stored the editor's local time with no zone, which the server
reads as UTC, and cut existing dates to the minute, so every post with seconds
in its date counted as changed as soon as it was opened. Dates are now written
in UTC to the minute (2019-09-30T11:44:00Z), and the export writes them the
same way. Empty optional fields are left out instead of saved as "", which
for description would have hidden the excerpt the site falls back on.