CI: Gitea Actions web auto-deploy (runner-on-server) + signing prep

- .gitea/workflows/ci.yml rewritten for a self-hosted runner co-located with
  the host Docker daemon + Traefik: push to master -> test -> deploy-web
  (docker compose up --build in place; no SSH, no registry). APK job documented
  as the next iteration (socket-safe build+extract; signing secrets already set).
- .gitignore: never commit the release keystore (*.keystore + wisp-release.keystore).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -13,6 +13,8 @@ expo-env.d.ts
 .kotlin/
 *.orig.*
 *.jks
+*.keystore
+wisp-release.keystore
 *.p8
 *.p12
 *.key