feat(deploy): deploy a release by hand from Gitea Actions

A deploy workflow, started only by hand (or through the API) and only
from master, pulls the chosen image (release tag, sha or latest) and
runs that image's own update.sh against VM103's compose directory
through the Docker socket. update.sh now copies the database through the
running server first, installs the image's compose.yaml and update.sh
with --install, and restores the previous compose file together with
the previous image when the new version does not come up. CI also
builds release tags v*.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -1,5 +1,5 @@
-# CI: `npm run check` on every push; on master/foundations also build the image and push it to the Gitea registry.
-# It does not deploy: VM103 pulls the image with deploy/update.sh (docs/DEPLOY.md).
+# CI: `npm run check` on every push; on master/foundations and on release tags (v…) also build the image and push it to
+# the Gitea registry. It does not deploy: that is the deploy workflow, started by hand (docs/DEPLOY.md).
 name: ci
 
 on:
@@ -28,7 +28,7 @@ jobs:
 
   publish:
     needs: check
-    if: github.ref_name == 'master' || github.ref_name == 'foundations'
+    if: github.ref_name == 'master' || github.ref_name == 'foundations' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4