chore(deploy): images OCI Gitea + compose production + CI

Recrée les fichiers de déploiement perdus lors de la restauration du repo.

- docker-compose.deploy.yml : production basée sur les images publiées
  (git.maison43gil.com/gilles/home_hub:{backend,frontend}-latest), sans build:,
  avec service backend-migrate (alembic upgrade head) avant le démarrage
- .gitea/workflows/build.yml : CI Gitea Actions, build+push des 2 images
- backend/.dockerignore + frontend/.dockerignore : images propres, sans secrets
- .env.example : template complet sans secret réel (placeholder change-me)
- README : section déploiement OCI (build manuel, CI, serveur, note 413 proxy)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.deploy.yml

@@ -0,0 +1,109 @@
+# Environnement de PRODUCTION — images publiées sur le registre OCI Gitea.
+# Aucune image n'est reconstruite ici (pas de build:). Source unique de vérité :
+#   git.maison43gil.com/gilles/home_hub
+#
+# Utilisation :
+#   docker login git.maison43gil.com
+#   docker compose -f docker-compose.deploy.yml pull
+#   docker compose -f docker-compose.deploy.yml up -d
+#
+# Les secrets proviennent du fichier .env (voir .env.example).
+services:
+  db:
+    image: postgres:16-alpine
+    container_name: home_hub_db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-homehub}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD requis}
+      POSTGRES_DB: ${POSTGRES_DB:-homehub}
+    volumes:
+      - db_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-homehub}"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  redis:
+    image: redis:7-alpine
+    container_name: home_hub_redis
+    restart: unless-stopped
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  # Applique les migrations Alembic puis se termine. Le backend attend son succès.
+  backend-migrate:
+    image: git.maison43gil.com/gilles/home_hub:backend-latest
+    container_name: home_hub_migrate
+    user: "1000:1000"
+    command: alembic upgrade head
+    environment:
+      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-homehub}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD requis}@db:5432/${POSTGRES_DB:-homehub}
+      DATA_DIR: /data
+    volumes:
+      - ./data:/data
+    depends_on:
+      db:
+        condition: service_healthy
+
+  backend:
+    image: git.maison43gil.com/gilles/home_hub:backend-latest
+    container_name: home_hub_backend
+    restart: unless-stopped
+    user: "1000:1000"
+    environment:
+      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-homehub}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD requis}@db:5432/${POSTGRES_DB:-homehub}
+      UPLOAD_DIR: /data/uploads
+      DATA_DIR: /data
+      REDIS_URL: redis://redis:6379
+      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3001}
+      MCP_API_KEY: ${MCP_API_KEY:?MCP_API_KEY requis}
+    volumes:
+      - ./data:/data
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      backend-migrate:
+        condition: service_completed_successfully
+
+  backend-worker:
+    image: git.maison43gil.com/gilles/home_hub:backend-latest
+    container_name: home_hub_worker
+    restart: unless-stopped
+    user: "1000:1000"
+    command: arq app.workers.notes_worker.WorkerSettings
+    environment:
+      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-homehub}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD requis}@db:5432/${POSTGRES_DB:-homehub}
+      UPLOAD_DIR: /data/uploads
+      DATA_DIR: /data
+      REDIS_URL: redis://redis:6379
+    volumes:
+      - ./data:/data
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      backend-migrate:
+        condition: service_completed_successfully
+
+  frontend:
+    image: git.maison43gil.com/gilles/home_hub:frontend-latest
+    container_name: home_hub_frontend
+    restart: unless-stopped
+    ports:
+      - "${FRONTEND_PORT:-3001}:80"
+    depends_on:
+      - backend
+
+volumes:
+  db_data:
+  redis_data: