Add the cnxvinyl.lol test site with a Gitea deploy workflow

site/ builds the internal test site: public/ served as is (landing page,
robots.txt, static sites) plus demo pages copied out of docs/ (the plant
operation page at /demos/plant-operation/). build.sh fails on dead
internal links and stamps version.txt.

.gitea/workflows/deploy-site.yml rsyncs site/dist to the buildfor.life
web server with the blog's two-directory rename swap, checks version.txt
on the server, purges Cloudflare when a token is set, and checks the
public URL. Secret names match the blog's workflow.

site/Caddyfile is the virtual host to append on s1 (noindex everywhere,
Cloudflare-only like the blog apex, www redirect). site/README.md has the
one-time setup: DNS, Caddy, web root, secrets, runner.

site/build.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Assemble the cnxvinyl.lol web root in site/dist.
+#
+#   site/public/   copied verbatim: landing page, robots.txt, and any static
+#                  site dropped in as its own directory (site/public/<name>/)
+#   DEMOS below    pages copied out of docs/, so docs/ stays their one source
+#
+# Run locally with `bash site/build.sh`, then open site/dist/index.html.
+# CI (.gitea/workflows/deploy-site.yml) runs the same script and deploys
+# site/dist as it is.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+out=site/dist
+rm -rf "$out"
+mkdir -p "$out"
+cp -R site/public/. "$out/"
+
+# "<source in the repo> <path under the web root>"
+DEMOS=(
+	"docs/plant-operation.html demos/plant-operation/index.html"
+)
+for entry in "${DEMOS[@]}"; do
+	read -r src dst <<<"$entry"
+	mkdir -p "$out/$(dirname "$dst")"
+	cp "$src" "$out/$dst"
+done
+
+# The deploy job reads this back from the server to confirm what is live.
+git rev-parse HEAD >"$out/version.txt" 2>/dev/null || echo unknown >"$out/version.txt"
+
+# Fail on a dead internal link: every href/src in every page that points
+# inside the site must resolve to a file in dist.
+dead=0
+while IFS= read -r page; do
+	dir=$(dirname "$page")
+	while IFS= read -r ref; do
+		# shellcheck disable=SC2016 # literal ${ and {{ mark JS/template strings
+		case "$ref" in
+		'' | '#'* | http:* | https:* | mailto:* | tel:* | data:* | javascript:* | *'${'* | *'{{'*) continue ;;
+		esac
+		ref=${ref%%#*}
+		ref=${ref%%\?*}
+		case "$ref" in
+		/*) target="$out$ref" ;;
+		*) target="$dir/$ref" ;;
+		esac
+		[ -d "$target" ] && target="${target%/}/index.html"
+		if [ ! -f "$target" ]; then
+			echo "dead link in ${page#"$out"/}: $ref" >&2
+			dead=1
+		fi
+	done < <(grep -o -E '(href|src)="[^"]*"' "$page" | sed -E 's/^(href|src)="//; s/"$//')
+done < <(find "$out" -name '*.html')
+[ "$dead" -eq 0 ] || exit 1
+
+echo "built $out: $(find "$out" -type f | wc -l | tr -d ' ') files"