ci: move image build off-infra to GHA -> ghcr (ADR-0002)

Generated by infra/scripts/offinfra-onboard: GHA builds+tests on the
GitHub mirror, pushes ghcr.io/viktorbarzin/kms-website, then triggers the
Woodpecker deploy (repo 203). Old in-cluster build pipeline
removed: .woodpecker.yml

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.woodpecker/deploy.yml

@@ -0,0 +1,20 @@
+# Auto-deploy, triggered ONLY by the GitHub Actions build POSTing to the
+# Woodpecker API (manual event, with IMAGE_TAG + IMAGE_NAME) after a successful
+# off-infra build+push to GHCR (ADR-0002). event:[manual] (NOT push) so the
+# Forgejo->GitHub mirror's raw pushes don't fire a spurious deploy.
+# The woodpecker-agent SA is cluster-admin — no kubeconfig needed.
+# Generated by infra/scripts/offinfra-onboard.
+when:
+  - event: manual
+
+steps:
+  - name: check-vars
+    image: alpine
+    commands:
+      - "[ -n \"$IMAGE_TAG\" ] || (echo 'IMAGE_TAG not set — refusing to deploy'; exit 1)"
+
+  - name: deploy
+    image: bitnami/kubectl:latest
+    commands:
+      - "kubectl -n kms set image deployment/kms-web-page kms-web-page=${IMAGE_NAME}:${IMAGE_TAG}"
+      - "kubectl -n kms rollout status deployment/kms-web-page --timeout=300s"