Add hardened Docker support and multi-arch CI

Multi-stage Dockerfile (non-root, Tor-ready), compose file, and
entrypoints. Forgejo CI builds linux/amd64+arm64, scans with
checksum-verified Grype, and pins all actions to commit SHA.
Makefile gains venv bootstrap and docker targets; server.py gains
a --bind flag.

1 files changed, 0 insertions, 40 deletions

diff --git a/.gitea/workflows/git-sync.yaml b/.gitea/workflows/git-sync.yaml
deleted file mode 100644
index f1028c5..0000000
--- a/.gitea/workflows/git-sync.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: git-sync-with-mirror
-
-on:
-  push:
-    branches: [ master ]
-  workflow_dispatch:
-
-jobs:
-  git-sync:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: git-sync
-        env:
-          git_sync_source_repo: git@git.fridu.us:heckyel/yt-local.git
-          git_sync_destination_repo: ssh://git@c.fridu.us/software/yt-local.git
-        if: env.git_sync_source_repo && env.git_sync_destination_repo
-        uses: actions/git-sync@v1
-        with:
-          source_repo: git@git.fridu.us:heckyel/yt-local.git
-          source_branch: "master"
-          destination_repo: ssh://git@c.fridu.us/software/yt-local.git
-          destination_branch: "master"
-          source_ssh_private_key: ${{ secrets.GIT_SYNC_SOURCE_SSH_PRIVATE_KEY }}
-          destination_ssh_private_key:  ${{ secrets.GIT_SYNC_DESTINATION_SSH_PRIVATE_KEY }}
-
-      - name: git-sync-sourcehut
-        env:
-          git_sync_source_repo: git@git.fridu.us:heckyel/yt-local.git
-          git_sync_destination_repo: git@git.sr.ht:~heckyel/yt-local
-        if: env.git_sync_source_repo && env.git_sync_destination_repo
-        uses: actions/git-sync@v1
-        with:
-          source_repo: git@git.fridu.us:heckyel/yt-local.git
-          source_branch: "master"
-          destination_repo: git@git.sr.ht:~heckyel/yt-local
-          destination_branch: "master"
-          source_ssh_private_key: ${{ secrets.GIT_SYNC_SOURCE_SSH_PRIVATE_KEY }}
-          destination_ssh_private_key:  ${{ secrets.GIT_SYNC_DESTINATION_SSH_PRIVATE_KEY }}
-        continue-on-error: true