Validate production config, add CI, and build from locked dependencies

- Fail startup on unsafe or malformed production settings (scripts/validate_config.py),
  run it before migrations, and stop on a failed `aerich upgrade`.
- Forward the context-budget, timeout and metrics settings through Compose; accept
  the historical TAVILIY_API_KEY spelling.
- Build the image from uv.lock and yarn.lock in a multi-stage Dockerfile.
- Add Gitea Actions CI: Ruff, unit tests, context evaluation, frontend tests,
  typecheck and build.
- Update README and deployment/development docs to match the current stack.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/validate_config.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Validate local .env and process settings without importing the application."""
+
+import argparse
+import os
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from dotenv import load_dotenv
+
+from config.validation import ConfigurationError, validate_configuration
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--development",
+        action="store_true",
+        help="allow missing secrets and local URLs",
+    )
+    args = parser.parse_args()
+    load_dotenv(Path(__file__).resolve().parents[1] / ".env", override=False)
+    try:
+        validate_configuration(os.environ, production=not args.development)
+    except ConfigurationError as error:
+        print(error, file=sys.stderr)
+        return 1
+    print("Configuration valid.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())