Load content from Gitea directly, drop the local clone; add deploy workflow

load_questions_from_gitea (content.rs) fetches question YAML straight
from the questions repo's public Gitea contents API at startup instead
of scanning a local directory - one fewer moving part in production
(no git clone to keep in sync, no separate questions-repo deploy
workflow). Still just an in-memory startup load, same as before -
served from RAM for every request, no per-request network call.
Verified against the real repo (all 5 questions fetch correctly).

CONTENT_DIR is replaced by CONTENT_REPO/CONTENT_BRANCH, defaulting to
the real questions repo so local dev needs no env override.

Also adds .gitea/workflows/deploy.yml: builds with cargo-leptos,
ships the release under /srv/app/uhhm-portal (the generic app@.service
deploy layout), writes /etc/app/uhhm-portal.env from this repo's own
Actions Variables/Secrets, restarts the service, and drops this app's
Caddy routing snippet into services.d/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/main.rs

@@ -25,10 +25,11 @@ async fn main() -> anyhow::Result<()> {
     let addr = leptos_options.site_addr;
     let routes = generate_route_list(App);
 
-    let content_dir = std::env::var("CONTENT_DIR")
-        .unwrap_or_else(|_| "../portal-content/questions".to_string());
-    let questions = content::load_questions(std::path::Path::new(&content_dir))?;
-    tracing::info!(count = questions.len(), dir = %content_dir, "loaded content");
+    let content_repo = std::env::var("CONTENT_REPO")
+        .unwrap_or_else(|_| "https://project.uhhm.no/uhhm/questions".to_string());
+    let content_branch = std::env::var("CONTENT_BRANCH").unwrap_or_else(|_| "main".to_string());
+    let questions = content::load_questions_from_gitea(&content_repo, &content_branch, "questions").await?;
+    tracing::info!(count = questions.len(), repo = %content_repo, branch = %content_branch, "loaded content");
 
     let nats_url =
         std::env::var("NATS_URL").unwrap_or_else(|_| "nats://127.0.0.1:4222".to_string());