ci: deploy site.yaml from Forgejo Actions

Service changes were made by hand on the servers, which is how the
repository drifted. Apply site.yaml from a workflow instead: every
push dry-runs it against production, and a push to main applies it.

Jobs run in containers on asxpio-services. asxpio-ops is reached over
the private network; the services host is reached through asxpio-ops,
because a container connecting to its own host arrives from a Docker
bridge address that sshd and the firewall refuse. Host keys are pinned
in known_hosts.

Ansible comes from a pinned nixpkgs revision so every run uses the
same version.

Assisted-by: Claude:fable-5-2

ansible/inventory/ci.yaml

@@ -0,0 +1,24 @@
+---
+# Inventory for the Forgejo Actions runner. Jobs run in containers on
+# asxpio-services, so asxpio-ops is reached over the VPC. The services
+# host itself is reached through asxpio-ops: a container talking to its
+# own host arrives from a Docker bridge address, which sshd and the
+# firewall both refuse.
+
+all:
+  vars:
+    ansible_user: deploy
+    ansible_python_interpreter: /usr/bin/python3
+
+  children:
+    asxpio:
+      children:
+        ops_servers:
+          hosts:
+            asxpio-ops:
+              ansible_host: "{{ vpc_ip }}"
+        services_servers:
+          hosts:
+            asxpio-services:
+              ansible_host: "{{ vpc_ip }}"
+              ansible_ssh_common_args: "-o ProxyJump=deploy@{{ asxpio_ops_vpc_ip }}"