Fix CI/CD for Forgejo-on-swarm topology; add runner swarm compose

- build.yml: clarify that runner needs Docker socket; SSH deploy uses
  DEPLOY_PATH secret so app host path is configurable; --no-deps so
  db/ollama containers are left untouched during deploy
- infra/runner-swarm.yml: act_runner as a Docker service on the Forgejo
  host — mounts host socket for buildx, writes act_runner config via
  one-shot init container, connects to fabled_backend network

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -1,14 +1,16 @@
 # Runs only on pushes to main.
-# Builds the Docker image, pushes it to the Forgejo container registry,
-# then SSHes into the deploy host and restarts the service.
+# Builds the Docker image on the CI runner host (which has Docker socket access),
+# pushes it to the Forgejo container registry, then SSHes to the app host to restart.
 #
-# Required secrets (set in Forgejo repo → Settings → Secrets):
-#   REGISTRY_USER    — your Forgejo username
-#   REGISTRY_TOKEN   — Forgejo personal access token (write:packages scope)
-#   DEPLOY_HOST      — hostname or IP of the server running the app
-#   DEPLOY_USER      — SSH username on that server
-#   DEPLOY_SSH_KEY   — private SSH key (the public key must be in authorized_keys on the server)
-#   DEPLOY_PATH      — absolute path to the directory containing docker-compose.yml
+# Runner requirement: act_runner with /var/run/docker.sock mounted (see infra/runner-swarm.yml).
+#
+# Required secrets (Forgejo repo → Settings → Secrets):
+#   REGISTRY_USER      — your Forgejo username (bvandeusen)
+#   REGISTRY_TOKEN     — Forgejo personal access token with write:packages scope
+#   DEPLOY_HOST        — IP or hostname of the server running fabledassistant
+#   DEPLOY_USER        — SSH user on that server
+#   DEPLOY_SSH_KEY     — private SSH key (matching public key must be in authorized_keys on app host)
+#   DEPLOY_PATH        — absolute path to the directory with docker-compose.yml on the app host
 name: Build & Deploy
 
 on:
@@ -44,9 +46,9 @@ jobs:
           tags: |
             ${{ env.IMAGE }}:latest
             ${{ env.IMAGE }}:${{ github.sha }}
-          # Registry-side layer cache — dramatically speeds up rebuilds.
-          # On first run there is no cache so it builds cold; after that
-          # unchanged layers (npm install, pip install) are reused.
+          # Registry-side layer cache lives in the Forgejo container registry.
+          # Unchanged layers (npm install, pip install) are reused across builds,
+          # cutting typical build time from ~4 min to ~45 sec after the first run.
           cache-from: type=registry,ref=${{ env.IMAGE }}:cache
           cache-to: type=registry,ref=${{ env.IMAGE }}:cache,mode=max
 
@@ -55,17 +57,19 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - name: Pull new image and restart
+      - name: Pull new image and restart app
         uses: appleboy/ssh-action@v1
         with:
           host: ${{ secrets.DEPLOY_HOST }}
           username: ${{ secrets.DEPLOY_USER }}
           key: ${{ secrets.DEPLOY_SSH_KEY }}
+          # Pulls only the app service image, restarts only the app container.
+          # Database and Ollama containers are left untouched (--no-deps).
           script: |
             set -e
-            cd ${{ secrets.DEPLOY_PATH }}
-            echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.fabledsword.com \
-              -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+            echo "${{ secrets.REGISTRY_TOKEN }}" | \
+              docker login git.fabledsword.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+            cd "${{ secrets.DEPLOY_PATH }}"
             docker compose pull app
-            docker compose up -d --no-build app
+            docker compose up -d --no-build --no-deps app
             docker image prune -f