Validate production config, add CI, and build from locked dependencies

- Fail startup on unsafe or malformed production settings (scripts/validate_config.py),
  run it before migrations, and stop on a failed `aerich upgrade`.
- Forward the context-budget, timeout and metrics settings through Compose; accept
  the historical TAVILIY_API_KEY spelling.
- Build the image from uv.lock and yarn.lock in a multi-stage Dockerfile.
- Add Gitea Actions CI: Ruff, unit tests, context evaluation, frontend tests,
  typecheck and build.
- Update README and deployment/development docs to match the current stack.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

startup.sh

@@ -1,4 +1,12 @@
 #!/bin/bash
+set -euo pipefail
+
+# Support the historical misspelling for externally supplied environments.
+if [ -z "${TAVILY_API_KEY:-}" ] && [ -n "${TAVILIY_API_KEY:-}" ]; then
+    export TAVILY_API_KEY="${TAVILIY_API_KEY}"
+fi
+
+python scripts/validate_config.py
 
 echo "Running database migrations..."
 aerich upgrade
@@ -7,8 +15,8 @@ aerich upgrade
 mkdir -p /app/data/obsidian
 
 # Start continuous Obsidian sync if enabled
-if [ "${OBSIDIAN_CONTINUOUS_SYNC}" = "true" ]; then
-    if [ -z "${OBSIDIAN_EMAIL}" ] || [ -z "${OBSIDIAN_PASSWORD}" ] || [ -z "${OBSIDIAN_VAULT_ID}" ]; then
+if [ "${OBSIDIAN_CONTINUOUS_SYNC:-false}" = "true" ]; then
+    if [ -z "${OBSIDIAN_EMAIL:-}" ] || [ -z "${OBSIDIAN_PASSWORD:-}" ] || [ -z "${OBSIDIAN_VAULT_ID:-}" ]; then
         echo "WARNING: OBSIDIAN_EMAIL, OBSIDIAN_PASSWORD, or OBSIDIAN_VAULT_ID not set. Skipping sync."
     else
         echo "Setting up Obsidian sync..."
@@ -20,7 +28,7 @@ if [ "${OBSIDIAN_CONTINUOUS_SYNC}" = "true" ]; then
            ob sync-setup \
                --vault "${OBSIDIAN_VAULT_ID}" \
                --path "${VAULT_PATH}" \
-               --password "${OBSIDIAN_E2E_PASSWORD}" \
+               --password "${OBSIDIAN_E2E_PASSWORD:-}" \
                --device-name "${OBSIDIAN_DEVICE_NAME:-simbarag}"; then
             # Remove stale lock from previous container run
             rm -rf "${VAULT_PATH}/.obsidian/.sync.lock"
@@ -36,4 +44,4 @@ if [ "${OBSIDIAN_CONTINUOUS_SYNC}" = "true" ]; then
 fi
 
 echo "Starting application..."
-python app.py
+exec python app.py