Add the cnxvinyl.lol test site with a Gitea deploy workflow

site/ builds the internal test site: public/ served as is (landing page,
robots.txt, static sites) plus demo pages copied out of docs/ (the plant
operation page at /demos/plant-operation/). build.sh fails on dead
internal links and stamps version.txt.

.gitea/workflows/deploy-site.yml rsyncs site/dist to the buildfor.life
web server with the blog's two-directory rename swap, checks version.txt
on the server, purges Cloudflare when a token is set, and checks the
public URL. Secret names match the blog's workflow.

site/Caddyfile is the virtual host to append on s1 (noindex everywhere,
Cloudflare-only like the blog apex, www redirect). site/README.md has the
one-time setup: DNS, Caddy, web root, secrets, runner.

site/Caddyfile

@@ -0,0 +1,40 @@
+# cnxvinyl.lol: internal test site on the buildfor.life web server (s1).
+# Static web root /var/www/cnxvinyl.lol, filled by
+# .gitea/workflows/deploy-site.yml in the cnx_vinyl repo.
+#
+# Append these blocks to /etc/caddy/Caddyfile on s1. They reuse the
+# cloudflare_only and security_headers snippets defined there for
+# buildfor.life (buildfor_life_web: infra/caddy/Caddyfile.example); if
+# they are missing, validate fails with "File to import not found:
+# cloudflare_only" and they have to be copied in from the example first.
+#   caddy validate --config /etc/caddy/Caddyfile
+#   systemctl reload caddy
+#
+# Cloudflare: both names proxied (orange cloud), SSL/TLS mode "Full (strict)".
+# "Flexible" sends plain HTTP to Caddy, which redirects to HTTPS: a loop.
+# Same rule as the buildfor.life apex: if a record is ever switched to DNS
+# only, remove "import cloudflare_only" first or that name goes dark.
+
+cnxvinyl.lol {
+	import cloudflare_only
+	import security_headers
+	header X-Frame-Options "SAMEORIGIN"
+	# Internal testing: keep every page and file out of search engines.
+	header X-Robots-Tag "noindex, nofollow"
+
+	# Optional login for the whole site. Make the hash on s1 with
+	#   caddy hash-password
+	# then uncomment and fill in:
+	# basic_auth {
+	# 	<user> <hash>
+	# }
+
+	root * /var/www/cnxvinyl.lol
+	encode zstd gzip
+	file_server
+}
+
+www.cnxvinyl.lol {
+	import cloudflare_only
+	redir https://cnxvinyl.lol{uri} permanent
+}