deploy: Dockerfile + nginx + Gitea Actions build

Two-stage build (node:22 → nginx:1.27) bakes dist/ into a static image.
nginx reverse-proxies /api/* to demo.flow-master.ai so live mode works
same-origin without CORS. CI runs vitest + build, then publishes
gitea.flow-master.ai/shad/mission-control-demo:sha-${git} on push to main.

Constraint: backend rejects cross-origin → same-origin proxy required
Confidence: high
Scope-risk: narrow
Not-tested: image actually built in Gitea Actions (requires registry secret)

nginx.conf

@@ -0,0 +1,31 @@
+server {
+  listen 80;
+  server_name _;
+  root /usr/share/nginx/html;
+  index index.html;
+
+  # Reverse-proxy /api to the demo backend so live mode works
+  # same-origin without CORS gymnastics. Backend is reached via the
+  # cluster-internal service rewritten by the ingress to demo.flow-master.ai.
+  location /api/ {
+    proxy_pass https://demo.flow-master.ai;
+    proxy_set_header Host demo.flow-master.ai;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_ssl_server_name on;
+    proxy_http_version 1.1;
+    proxy_read_timeout 30s;
+  }
+
+  # SPA: everything else falls back to index.html.
+  location / {
+    try_files $uri $uri/ /index.html;
+    add_header Cache-Control "no-cache";
+  }
+
+  # Static assets with content hashes in their filenames cache forever.
+  location /assets/ {
+    try_files $uri =404;
+    add_header Cache-Control "public, max-age=31536000, immutable";
+  }
+}