Fix Gitea CI deploy path and ban production hot-patches.

Drop the flaky host Node docker step (image build already runs Vite), hard-reset the deploy checkout to the CI SHA, and fail deploy if assets still emit http://.

.gitea/workflows/ci.yml

@@ -33,22 +33,6 @@ jobs:
       - name: Install PHP dependencies
         run: composer install --no-interaction --prefer-dist --optimize-autoloader
 
-      - name: Build frontend assets
-        run: |
-          set -euo pipefail
-          docker run --rm \
-            -u "$(id -u):$(id -g)" \
-            -e HOME=/tmp \
-            -e VITE_APP_NAME=AndyTranscribe \
-            -e VITE_REVERB_APP_KEY=andytranscribe-key \
-            -e "VITE_REVERB_HOST=${VITE_REVERB_HOST}" \
-            -e "VITE_REVERB_PORT=${VITE_REVERB_PORT}" \
-            -e "VITE_REVERB_SCHEME=${VITE_REVERB_SCHEME}" \
-            -v "$PWD:/app" \
-            -w /app \
-            node:22-alpine \
-            sh -c "npm ci && npm run build"
-
       - name: Run tests
         run: |
           set -euo pipefail
@@ -87,7 +71,7 @@ jobs:
           TAG_SHA="${REGISTRY}/${REPO_LC}:${{ gitea.sha }}"
           TAG_LATEST="${REGISTRY}/${REPO_LC}:latest"
           echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${REGISTRY}" -u "${{ gitea.actor }}" --password-stdin
-          docker build \
+          DOCKER_BUILDKIT=1 docker build \
             --build-arg VITE_APP_NAME=AndyTranscribe \
             --build-arg VITE_REVERB_APP_KEY=andytranscribe-key \
             --build-arg "VITE_REVERB_HOST=${VITE_REVERB_HOST}" \
@@ -119,6 +103,7 @@ jobs:
       - name: Deploy production
         env:
           DEPLOY_PATHS: ${{ secrets.DEPLOY_PATHS }}
+          DEPLOY_SHA: ${{ gitea.sha }}
         run: |
           set -euo pipefail
           REPO_LC="$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]')"