feat(ci): add Gitea Actions deploy pipeline and fix prod image module assets

- Add .gitea/workflows/deploy.yaml: QA → build prod image → SCP to server → docker load + compose up + module:sync
- Fix Dockerfile prod stage: copy module web assets directly from modules/*/web/ instead of resolving symlinks (symlinks are excluded via .dockerignore and break on Windows/CI)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker/php/Dockerfile

@@ -50,15 +50,16 @@ RUN composer install \
 # Apply production PHP hardening AFTER composer is done.
 COPY docker/php/php.prod.ini /usr/local/etc/php/conf.d/zzz-minty-prod.ini
 
-# Publish module web assets as real files (not symlinks) so web_init cp works correctly.
-# Symlinks from web/modules/<id> → modules/<id>/web are replaced by actual copies,
-# because web_init uses "cp -rp" which follows symlinks only to directories, not files.
-RUN find /var/www/web/modules -maxdepth 1 -mindepth 1 -type l | while read link; do \
-        id=$(basename "$link"); \
-        target=$(readlink "$link"); \
-        rm "$link"; \
-        cp -r "$target" "/var/www/web/modules/$id"; \
-    done || true
+# Publish module web assets as real files so web_init cp works correctly.
+# web/modules/ is excluded via .dockerignore (absolute symlinks break on Windows/CI),
+# so we copy directly from modules/<id>/web/ instead of resolving symlinks.
+RUN mkdir -p /var/www/web/modules && \
+    for mod_web in /var/www/modules/*/web; do \
+        id=$(basename "$(dirname "$mod_web")"); \
+        if [ -d "$mod_web" ]; then \
+            cp -r "$mod_web" "/var/www/web/modules/$id"; \
+        fi; \
+    done
 
 # Create runtime directories (storage/ and var/ are excluded via .dockerignore;
 # they will be mounted as volumes in production — we just ensure the paths exist).