Overhaul deployment to Gitea Actions CI/CD, remove update.sh

Production no longer builds from source or self-updates via cron/git pull:
setup.sh now only provisions the server once (Docker, /opt/anouma, a
restricted `anouma-deploy` SSH user whose key can only ever run
deploy.sh, generated secrets). All future deployments run through
.gitea/workflows/ci.yml (lint/typecheck/test/build on every push) and
release.yml (on a vX.Y.Z tag: build the image, push it to the Gitea
registry, then SSH-trigger deploy.sh on the server), which pulls,
migrates, restarts, healthchecks, backs up the database first, and
automatically rolls back the code on a failed healthcheck.

docker-compose.yml's app service now runs a registry image
(${ANOUMA_IMAGE}) instead of building locally.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -1,3 +1,9 @@
+# This file documents every variable the app/deployment actually reads.
+# In production, setup.sh generates the real file at /opt/anouma/.env for
+# you — you shouldn't need to hand-edit this. For local development, copy
+# this to .env at the repo root and fill in DATABASE_URI/PAYLOAD_SECRET
+# (see README.md → "Lokale Entwicklung").
+
 # ── Database ────────────────────────────────────────────────────────────
 # PostgreSQL connection string used by Payload. setup.sh fills this in
 # automatically (host "postgres" when running the full stack via Docker
@@ -12,11 +18,11 @@ POSTGRES_PASSWORD=replace-with-a-long-random-secret
 POSTGRES_DB=anouma
 
 # ── Core secrets ────────────────────────────────────────────────────────
-# Signs Payload's auth tokens/cookies. Generate with: openssl rand -base64 48
+# Signs Payload's auth tokens/cookies. Generate with: openssl rand -hex 32
 PAYLOAD_SECRET=replace-with-a-long-random-secret
 
 # Signs meeting join tokens (kept separate from PAYLOAD_SECRET on purpose).
-# Generate with: openssl rand -base64 48
+# Generate with: openssl rand -hex 32
 MEETING_SESSION_SECRET=replace-with-a-long-random-secret
 
 # Sent as "Authorization: Bearer <value>" by the external cron job that
@@ -48,6 +54,12 @@ TURN_SERVER=
 TURN_USERNAME=
 TURN_PASSWORD=
 
+# ── SEO ──────────────────────────────────────────────────────────────────
+# Optional Google Search Console domain-verification token (Search Console →
+# Settings → Ownership verification → HTML tag → the "content" value only).
+# Leave empty if not verifying with Google. Never commit a real value here.
+GOOGLE_SITE_VERIFICATION=
+
 # ── Docker networking ───────────────────────────────────────────────────
 # Internal network name for ANOUMA's own containers.
 DOCKER_NETWORK=anouma-network
@@ -57,12 +69,24 @@ DOCKER_NETWORK=anouma-network
 # directly. Leave empty if you don't use one — setup.sh auto-detects this.
 NPM_NETWORK=
 
-# ── Updates & backups (used by update.sh) ──────────────────────────────
-# When true, setup.sh installs a cron entry that checks for new releases
-# and updates automatically. Off by default — update.sh can always be run
-# manually regardless of this setting.
-AUTO_UPDATE=false
-
-# How long (days) to keep database backups created by update.sh before
-# deleting them.
+# ── Backups (used by deploy.sh) ─────────────────────────────────────────
+# How long (days) to keep database backups created before every deployment.
 BACKUP_RETENTION_DAYS=14
+
+# ── Container registry & deployment (used by deploy.sh) ────────────────
+# Gitea's built-in container registry. deploy.sh builds nothing — it only
+# ever pulls this image (see .gitea/workflows/release.yml, which is what
+# actually builds and pushes it).
+REGISTRY=git.maro.run
+REGISTRY_REPO=maro/anouma
+# Only needed if the registry/repository requires authentication to pull.
+# Use a Gitea access token as the password, not your account password.
+REGISTRY_USERNAME=
+REGISTRY_PASSWORD=
+# Set automatically by deploy.sh on every successful deploy — do not edit
+# by hand. Empty until the first release has been deployed.
+ANOUMA_IMAGE=
+# Informational only (shown in the setup summary) — actual automatic
+# deployment is controlled by whether release.yml + its Gitea secrets are
+# configured, not by this flag.
+AUTO_DEPLOY=true