Add the cnxvinyl.lol test site with a Gitea deploy workflow

site/ builds the internal test site: public/ served as is (landing page,
robots.txt, static sites) plus demo pages copied out of docs/ (the plant
operation page at /demos/plant-operation/). build.sh fails on dead
internal links and stamps version.txt.

.gitea/workflows/deploy-site.yml rsyncs site/dist to the buildfor.life
web server with the blog's two-directory rename swap, checks version.txt
on the server, purges Cloudflare when a token is set, and checks the
public URL. Secret names match the blog's workflow.

site/Caddyfile is the virtual host to append on s1 (noindex everywhere,
Cloudflare-only like the blog apex, www redirect). site/README.md has the
one-time setup: DNS, Caddy, web root, secrets, runner.

docs/digital-factory.md

@@ -742,8 +742,9 @@ Build onward, part-time at launch; add it to the headcount.
 - Customer portal domain: the plant's brand domain (new zone on ns1/ns2,
   second cert on `web01`) or a name under `cnx.network` for launch.
   Internal testing has its own domain, `cnxvinyl.lol` (registered
-  2026-10-02 at Porkbun, on Porkbun's nameservers for now); the brand
-  domain decision stays open.
+  2026-10-02, DNS on Cloudflare): a static demo site built from
+  [`site/`](../site/README.md) and served by the buildfor.life web server,
+  not a plant service. The brand domain decision stays open.
 - Portal availability during a plant WAN outage: accept it (the portal is
   a view of live data) or add a read replica on the fleet side later.
 - Accounting and ERP: out of scope for the application; if an ERP is