Add prosekit rich-text field, Gitea repo embeds, automation KV read endpoint; fix apex/www session-cookie mismatch on /auth/callback

- type: prosekit requirement kind, backed by public/prosekit-editor.js
  (ProseMirror via prosekit, loaded from esm.sh, no bundler) - mirrors
  its HTML into a paired hidden input so it reuses the existing
  RwSignal/on:input wiring.
- Pasting a project.uhhm.no/<owner>/<repo> URL in the editor embeds a
  repo card, resolved server-side via a new /gitea-repo handler
  (content::gitea_repo_handler) so the browser never needs Gitea API
  CORS.
- New /automation/kv/{bucket} handler, bearer-token gated
  (AUTOMATION_READ_TOKEN), for backing automations (n8n) to read a
  NATS KV bucket without a browser session.
- Fix: a login started on one of apex/www set its session cookie
  there, but Kanidm's redirect_uri is fixed to PUBLIC_URL - landing
  the callback on a different, empty session ("no login in
  progress"). Caddy now redirects www -> apex so every visit stays on
  one canonical host.

.gitea/workflows/deploy.yml

@@ -80,6 +80,7 @@ jobs:
           # (no target/ prefix) - override so the running binary looks
           # in the right place for /pkg/*.
           LEPTOS_SITE_ROOT=site
+          AUTOMATION_READ_TOKEN=${{ secrets.PORTAL_AUTOMATION_READ_TOKEN }}
           EOF
 
       # No sudo: the runner's own unit sets NoNewPrivileges=yes, which
@@ -93,10 +94,22 @@ jobs:
 
       # No sudo here either - the runner is already in the `docker` group,
       # so it can talk to the Docker socket directly.
+      # Apex and www are separate cookie scopes (no shared Domain
+      # attribute on the session cookie), but Kanidm's redirect_uri is
+      # fixed to PUBLIC_URL - a login started on the other host set its
+      # session cookie there, then landed on PUBLIC_URL's callback with
+      # an empty session ("no login in progress"). Redirecting www to
+      # the naked domain keeps every visit on one canonical host
+      # instead - PUBLIC_URL (repo variable) is set to https://{$DOMAIN}
+      # to match.
       - name: Update Caddy routing
         run: |
           cat > /etc/caddy/services.d/uhhm-portal.caddy <<'EOF'
-          www.{$DOMAIN}, {$DOMAIN} {
+          www.{$DOMAIN} {
+          	redir https://{$DOMAIN}{uri} permanent
+          }
+
+          {$DOMAIN} {
           	reverse_proxy host.docker.internal:3010
           	log {
           		output file /var/log/caddy/www.log