Add Gitea Actions CI, ArgoCD Application, and Gitea Packages wiring

- .gitea/workflows/ci.yml: build → seo:lint → e2e → image build/push →
  bump k8s image tag and commit back (paths-ignore + [skip ci] guard)
- argocd/bcs-website-application.yaml: ArgoCD App (internal Gitea repoURL, k8s path)
- k8s: image → Gitea Packages path; kustomization images newTag stanza
- ADR-0007 (Gitea Actions + Packages), supersedes GHCR/GitHub bits of ADR-0001
- Reconcile gitops-deployment-strategy.md to Gitea

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/adr/0001-gitops-with-argocd.md

@@ -1,6 +1,8 @@
 # ADR-0001: GitOps deployment via ArgoCD (not Flux)
 
-**Status:** Accepted — 2026-07-15
+**Status:** Accepted — 2026-07-15 · CI/registry specifics (GitHub Actions + GHCR) **superseded by
+[ADR-0007](0007-gitea-actions-and-packages.md)** (Gitea Actions + Gitea Packages). The ArgoCD /
+GitOps model here stands.
 
 ## Context
 

docs/adr/0007-gitea-actions-and-packages.md

@@ -0,0 +1,33 @@
+# ADR-0007: CI on Gitea Actions, images in Gitea Packages
+
+**Status:** Accepted — 2026-07-15 · **Supersedes** the GitHub Actions + GHCR specifics of
+[ADR-0001](0001-gitops-with-argocd.md) (the ArgoCD/GitOps model itself stands).
+
+## Context
+
+The repo lives on the homelab's self-hosted **Gitea** (`bmr_bluecap/bcs-website`), not GitHub, so
+GitHub Actions and GHCR do not apply. Gitea runs an **`act_runner`** (GitHub-Actions-compatible)
+and a built-in **container registry** (Gitea Packages, OCI `/v2/` confirmed live at
+`10.66.15.22:3000`). The runner mounts `/var/run/docker.sock`; its label is `ubuntu-latest`
+(jobs run in a `node:18-bullseye` container).
+
+## Decision
+
+- **CI = Gitea Actions**, workflow at `.gitea/workflows/ci.yml`, `runs-on: ubuntu-latest`.
+- **Registry = Gitea Packages** at `10.66.15.22:3000/bmr_bluecap/bcs-website`, immutable
+  `<git-sha>` tags. Auth via the run's automatic token.
+- Pipeline: `npm ci` → build (typecheck) → `seo:lint` → Playwright e2e → build & push image →
+  bump the image tag in `k8s/kustomization.yaml` and commit back to `main` (`[skip ci]` +
+  `paths-ignore` to avoid a loop). **ArgoCD** then reconciles k3s (unchanged from ADR-0001).
+- **Package visibility: public** (recommended) — the image contains only the compiled public
+  site, so a public package removes the need for a cluster imagePullSecret. Private + an
+  External-Secrets-managed pull secret is the documented alternative.
+
+## Consequences
+
+- No external CI/registry dependency; everything stays in the homelab.
+- **New infra prerequisites** (see `docs/gitops-deployment-strategy.md`): k3s must trust the HTTP
+  registry (`registries.yaml` / `k3s_registry_mirrors` entry for `10.66.15.22:3000`); the runner
+  host's Docker daemon needs `10.66.15.22:3000` as an insecure registry; docker must be usable
+  from job containers (act_runner socket passthrough) or the build switches to kaniko.
+- `GHCR`/`GitHub` references in ADR-0001 and older doc revisions are superseded by this ADR.

docs/adr/README.md

@@ -14,3 +14,4 @@ Format: Status · Context · Decision · Consequences. Statuses: Proposed · Acc
 | [0004](0004-reuse-monylog-for-monitoring.md) | Reuse the monylog stack for ops monitoring (not Uptime Kuma) | Accepted |
 | [0005](0005-analytics-posthog-and-umami-trial.md) | Visitor analytics: PostHog + Umami side-by-side trial | Accepted |
 | [0006](0006-launch-insights-blog.md) | Launch a blog at /insights/ | Accepted |
+| [0007](0007-gitea-actions-and-packages.md) | CI on Gitea Actions, images in Gitea Packages | Accepted |