Add prosekit rich-text field, Gitea repo embeds, automation KV read endpoint; fix apex/www session-cookie mismatch on /auth/callback

- type: prosekit requirement kind, backed by public/prosekit-editor.js
  (ProseMirror via prosekit, loaded from esm.sh, no bundler) - mirrors
  its HTML into a paired hidden input so it reuses the existing
  RwSignal/on:input wiring.
- Pasting a project.uhhm.no/<owner>/<repo> URL in the editor embeds a
  repo card, resolved server-side via a new /gitea-repo handler
  (content::gitea_repo_handler) so the browser never needs Gitea API
  CORS.
- New /automation/kv/{bucket} handler, bearer-token gated
  (AUTOMATION_READ_TOKEN), for backing automations (n8n) to read a
  NATS KV bucket without a browser session.
- Fix: a login started on one of apex/www set its session cookie
  there, but Kanidm's redirect_uri is fixed to PUBLIC_URL - landing
  the callback on a different, empty session ("no login in
  progress"). Caddy now redirects www -> apex so every visit stays on
  one canonical host.

src/server/mod.rs

@@ -22,6 +22,11 @@ pub struct AppState {
     /// a lock, just an atomic pointer load, so a reload never blocks or
     /// is blocked by an in-flight request.
     pub questions: Arc<ArcSwap<HashMap<String, Question>>>,
+    /// `scheme://host` of the Gitea instance content is loaded from
+    /// (see `content::gitea_api_base`) - kept alongside `questions`
+    /// rather than re-derived per call, since `resolve_gitea_repo` needs
+    /// it too and has no other reason to see `CONTENT_REPO` itself.
+    pub gitea_base: String,
     pub oidc: Arc<oidc::Oidc>,
     /// `None` when `GARAGE_*` env vars aren't set - uploads are the one
     /// optional feature, everything else works without Garage.