Load content from Gitea directly, drop the local clone; add deploy workflow

load_questions_from_gitea (content.rs) fetches question YAML straight
from the questions repo's public Gitea contents API at startup instead
of scanning a local directory - one fewer moving part in production
(no git clone to keep in sync, no separate questions-repo deploy
workflow). Still just an in-memory startup load, same as before -
served from RAM for every request, no per-request network call.
Verified against the real repo (all 5 questions fetch correctly).

CONTENT_DIR is replaced by CONTENT_REPO/CONTENT_BRANCH, defaulting to
the real questions repo so local dev needs no env override.

Also adds .gitea/workflows/deploy.yml: builds with cargo-leptos,
ships the release under /srv/app/uhhm-portal (the generic app@.service
deploy layout), writes /etc/app/uhhm-portal.env from this repo's own
Actions Variables/Secrets, restarts the service, and drops this app's
Caddy routing snippet into services.d/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/content.rs

@@ -143,25 +143,77 @@ impl Requirement {
     }
 }
 
-/// Reads every `*.yaml` file in `dir` as a `Question`, keyed by its own
-/// `id`. Runs once at startup; no hot-reload yet - restart the process
-/// (or add a watcher later) to pick up content changes.
+/// Fetches every `*.yaml` file under `subdir` in a Gitea repo as a
+/// `Question`, keyed by its own `id`. `repo_url` is the repo's normal
+/// browser URL (e.g. `https://project.uhhm.no/uhhm/questions`) - the
+/// Gitea host, owner and repo name are all read from it. Runs once at
+/// startup, over Gitea's public contents API (no auth - the content
+/// repo is public); no hot-reload yet - restart the process (or add
+/// polling later) to pick up content changes.
 #[cfg(feature = "ssr")]
-pub fn load_questions(
-    dir: &std::path::Path,
+pub async fn load_questions_from_gitea(
+    repo_url: &str,
+    branch: &str,
+    subdir: &str,
 ) -> anyhow::Result<std::collections::HashMap<String, Question>> {
+    let parsed = url::Url::parse(repo_url)
+        .map_err(|e| anyhow::anyhow!("parsing content repo url {repo_url}: {e}"))?;
+    let api_base = format!(
+        "{}://{}",
+        parsed.scheme(),
+        parsed
+            .host_str()
+            .ok_or_else(|| anyhow::anyhow!("no host in content repo url {repo_url}"))?
+    );
+    let mut segments = parsed
+        .path_segments()
+        .ok_or_else(|| anyhow::anyhow!("no path in content repo url {repo_url}"))?;
+    let owner = segments
+        .next()
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("missing owner in content repo url {repo_url}"))?;
+    let repo = segments
+        .next()
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("missing repo name in content repo url {repo_url}"))?;
+
+    let client = openidconnect::reqwest::Client::new();
+    let list_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/contents/{subdir}?ref={branch}");
+    let listing = client
+        .get(&list_url)
+        .send()
+        .await
+        .map_err(|e| anyhow::anyhow!("listing {list_url}: {e}"))?
+        .error_for_status()
+        .map_err(|e| anyhow::anyhow!("listing {list_url}: {e}"))?
+        .text()
+        .await
+        .map_err(|e| anyhow::anyhow!("reading directory listing from {list_url}: {e}"))?;
+    let entries: Vec<serde_json::Value> = serde_json::from_str(&listing)
+        .map_err(|e| anyhow::anyhow!("parsing directory listing from {list_url}: {e}"))?;
+
     let mut out = std::collections::HashMap::new();
-    for entry in std::fs::read_dir(dir)
-        .map_err(|e| anyhow::anyhow!("reading content dir {}: {e}", dir.display()))?
-    {
-        let entry = entry?;
-        let path = entry.path();
-        if path.extension().and_then(|e| e.to_str()) != Some("yaml") {
+    for entry in entries {
+        let name = entry.get("name").and_then(|v| v.as_str()).unwrap_or("");
+        if !name.ends_with(".yaml") {
             continue;
         }
-        let raw = std::fs::read_to_string(&path)?;
-        let question: Question = serde_yaml::from_str(&raw)
-            .map_err(|e| anyhow::anyhow!("parsing {}: {e}", path.display()))?;
+        let download_url = entry
+            .get("download_url")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("no download_url for {name}"))?;
+        let raw = client
+            .get(download_url)
+            .send()
+            .await
+            .map_err(|e| anyhow::anyhow!("fetching {name}: {e}"))?
+            .error_for_status()
+            .map_err(|e| anyhow::anyhow!("fetching {name}: {e}"))?
+            .text()
+            .await
+            .map_err(|e| anyhow::anyhow!("reading {name}: {e}"))?;
+        let question: Question =
+            serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing {name}: {e}"))?;
         out.insert(question.id.clone(), question);
     }
     Ok(out)