ci: deploy native binary directly to LXC via SSH (drop Docker/registry)

Switch the runtime from a Docker image to a systemd service running the
native binary on the LXC host. The CI still uses Docker for the build
environment (maven:3.9.6-eclipse-temurin-21), but stops at producing the
static native binary.

Pipeline changes:
- Drop docker.io, docker-buildx, docker buildx, docker push, registry.
- Drop Dockerfile, compose.yaml, .dockerignore (no longer needed).
- Build native binary in CI container, SCP to LXC, run deploy script.
- Deploy script stops the service, swaps the binary, starts it, hits
  /q/health/live to verify.

LXC one-time setup (manual, run on the host):
- useradd runner (UID 1001)
- mkdir /opt/shot-crafter-calculator/{data,keys,deploy}
- copy RSA JWT keys into keys/
- install /etc/systemd/system/shot-crafter-calculator.service
- install /usr/local/bin/deploy-shot-crafter-calculator.sh
- useradd deployer + ssh keypair for the CI
- store DEPLOY_SSH_KEY secret in Gitea

Bootstrap the first deploy manually with scp + ssh before relying on CI.

compose.yaml

@@ -1,57 +0,0 @@
-# shot-crafter-calculator — Docker Compose
-#
-# Instalacion basica:
-#   docker compose pull          # descarga la imagen :latest
-#   docker compose up -d         # arranca en background
-#   docker compose logs -f       # ver logs
-#   docker compose down          # parar (los datos quedan en el volumen)
-#   docker compose down -v       # parar y BORRAR volumen (pierde la DB)
-#
-# Ver la DB H2:
-#   docker compose exec shot-crafter ls -la /work/data
-#   docker compose exec shot-crafter cat /work/data/shots.trace.db  # logs SQL
-#
-# Personalizacion via env vars (override con `docker compose run -e KEY=value`
-# o definiendolas en un .env al lado de este archivo):
-#   - QUARKUS_DATASOURCE_JDBC_URL  ruta de la DB (default: /work/data/shots.mv.db)
-#   - QUARKUS_HTTP_PORT            puerto (default: 8080)
-#   - QUARKUS_HTTP_HOST            bind interface (default: 0.0.0.0)
-#   - APP_AUTH_COOKIE_SECURE       'true' si va detras de HTTPS
-#   - APP_AUTH_COOKIE_NAME         nombre de la cookie
-#   - MP_JWT_VERIFY_PUBLICKEY_LOCATION      ruta a la clave publica RSA
-#   - SMALLRYE_JWT_SIGN_KEY_LOCATION       ruta a la clave privada RSA
-#
-# Ver .env.example para la lista completa.
-#
-# Pin a version especifica (recomendado en produccion):
-#   image: gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:1.0.0
-#   o
-#   docker compose pull gitea.danielarroyo.cl/proyectos/shot-crafter-calculator@sha256:...
-
-services:
-  shot-crafter:
-    image: gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest
-    container_name: shot-crafter
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    environment:
-      QUARKUS_HTTP_HOST: 0.0.0.0
-      QUARKUS_HTTP_PORT: 8080
-      QUARKUS_DATASOURCE_JDBC_URL: jdbc:h2:file:/work/data/shots;DB_CLOSE_DELAY=-1
-      APP_AUTH_COOKIE_SECURE: "false"
-      APP_AUTH_COOKIE_NAME: auth-token
-    volumes:
-      - shot-crafter-data:/work/data
-    healthcheck:
-      # curl contra /q/health/live (extension quarkus-smallrye-health).
-      # Devuelve 200 si la app esta viva. -f falla si el status != 2xx.
-      test: ["CMD", "curl", "-fsS", "--max-time", "5", "http://localhost:8080/q/health/live"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 30s
-
-volumes:
-  shot-crafter-data:
-    name: shot-crafter-data