ci: deploy native binary directly to LXC via SSH (drop Docker/registry)

Switch the runtime from a Docker image to a systemd service running the
native binary on the LXC host. The CI still uses Docker for the build
environment (maven:3.9.6-eclipse-temurin-21), but stops at producing the
static native binary.

Pipeline changes:
- Drop docker.io, docker-buildx, docker buildx, docker push, registry.
- Drop Dockerfile, compose.yaml, .dockerignore (no longer needed).
- Build native binary in CI container, SCP to LXC, run deploy script.
- Deploy script stops the service, swaps the binary, starts it, hits
  /q/health/live to verify.

LXC one-time setup (manual, run on the host):
- useradd runner (UID 1001)
- mkdir /opt/shot-crafter-calculator/{data,keys,deploy}
- copy RSA JWT keys into keys/
- install /etc/systemd/system/shot-crafter-calculator.service
- install /usr/local/bin/deploy-shot-crafter-calculator.sh
- useradd deployer + ssh keypair for the CI
- store DEPLOY_SSH_KEY secret in Gitea

Bootstrap the first deploy manually with scp + ssh before relying on CI.

.gitea/workflows/ci.yml

@@ -21,18 +21,16 @@ jobs:
       image: maven:3.9.6-eclipse-temurin-21
       options: --memory=8g
     steps:
-      - name: Install git, node, gcc, docker, buildx, and basic tools
+      - name: Install git, node, gcc, and basic tools
         run: |
           apt-get update
-          apt-get install -y git curl ca-certificates build-essential zlib1g-dev docker.io docker-buildx
+          apt-get install -y git curl ca-certificates build-essential zlib1g-dev openssh-client
           curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
           apt-get install -y nodejs
           rm -rf /var/lib/apt/lists/*
           git --version
           node --version
           gcc --version
-          docker --version
-          docker buildx version
 
       - name: Checkout
         uses: actions/checkout@v4
@@ -64,48 +62,20 @@ jobs:
         run: mvn package -Pnative -B -DskipTests -Dquarkus.native.native-image-xmx=4g -Dquarkus.native.binary-type=STATIC
 
       - name: Verify native binary
-        run: |
-          ls -la target/shot-crafter-calculator-1.0.0-runner
+        run: ls -la target/shot-crafter-calculator-1.0.0-runner
 
-      - name: Stage binary for Docker
-        run: |
-          mkdir -p build-output
-          cp target/shot-crafter-calculator-1.0.0-runner build-output/
-          chmod 775 build-output/shot-crafter-calculator-1.0.0-runner
-          echo "securerandom.source=file:/dev/urandom" >> build-output/shot-crafter-calculator-1.0.0-runner
-
-      - name: Build & Push Docker image
+      - name: Deploy to LXC
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           set -e
-          echo "=== Build Docker image ==="
-          docker buildx build -t shot-crafter-calculator:ci .
-          echo "=== Login to Gitea Registry ==="
-          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.danielarroyo.cl -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          SHORT_SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
-          echo "=== Tag ==="
-          docker tag shot-crafter-calculator:ci gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest
-          docker tag shot-crafter-calculator:ci gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:${SHORT_SHA}
-
-          push_with_retry() {
-            local ref="$1"
-            local attempt=1
-            local max_attempts=3
-            while [ $attempt -le $max_attempts ]; do
-              echo "=== Push (attempt $attempt/$max_attempts): $ref ==="
-              if docker push "$ref"; then
-                return 0
-              fi
-              echo "::warning::Push of $ref failed, retrying in 15s..."
-              sleep 15
-              attempt=$((attempt + 1))
-            done
-            echo "::error::Push of $ref failed after $max_attempts attempts"
-            return 1
-          }
-
-          push_with_retry "gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest"
-          push_with_retry "gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:${SHORT_SHA}"
-          echo "=== Logout ==="
-          docker logout gitea.danielarroyo.cl
-          echo "=== Done ==="
+          mkdir -p ~/.ssh
+          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
+          chmod 0600 ~/.ssh/deploy_key
+          ssh-keyscan -H localhost >> ~/.ssh/known_hosts
+          ssh -i ~/.ssh/deploy_key deployer@localhost \
+            "mkdir -p /opt/shot-crafter-calculator/deploy"
+          scp -i ~/.ssh/deploy_key \
+            target/shot-crafter-calculator-1.0.0-runner \
+            deployer@localhost:/opt/shot-crafter-calculator/deploy/application
+          ssh -i ~/.ssh/deploy_key deployer@localhost \
+            "sudo /usr/local/bin/deploy-shot-crafter-calculator.sh"