Fix CI/CD for Forgejo-on-swarm topology; add runner swarm compose

- build.yml: clarify that runner needs Docker socket; SSH deploy uses
  DEPLOY_PATH secret so app host path is configurable; --no-deps so
  db/ollama containers are left untouched during deploy
- infra/runner-swarm.yml: act_runner as a Docker service on the Forgejo
  host — mounts host socket for buildx, writes act_runner config via
  one-shot init container, connects to fabled_backend network

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/runner-swarm.yml

@@ -0,0 +1,100 @@
+# Forgejo Actions runner — deploy this on the FORGEJO HOST alongside the Forgejo stack.
+#
+# The runner connects outbound to git.fabledsword.com to receive jobs.
+# No inbound connections from Forgejo are needed.
+# The host Docker socket is mounted so the build job can use Docker Buildx.
+#
+# One-time setup on the Forgejo host:
+#
+#   1. Get a registration token:
+#      Forgejo → Site Administration → Runners → Create Runner
+#      (or per-repo: repo → Settings → Actions → Runners)
+#
+#   2. Create an env file (keep this off git):
+#      echo 'RUNNER_TOKEN=your_token_here' > /nfs/data/fabledsword/act_runner/.env
+#
+#   3. Deploy:
+#      docker stack deploy -c runner-swarm.yml act-runner
+#      (or: docker compose -f runner-swarm.yml up -d  if not using swarm mode for this)
+#
+# Note: docker stack deploy does not support `volumes.driver_opts` or bind mounts
+# in the same way as compose. If you hit swarm limitations with the socket bind mount,
+# run this with plain `docker compose` instead of `docker stack deploy` — the runner
+# doesn't need swarm-specific features.
+
+networks:
+  fabled_backend:
+    external: true
+
+volumes:
+  act_runner_data:
+
+services:
+  act_runner:
+    image: gitea/act_runner:latest
+    restart: unless-stopped
+    environment:
+      - GITEA_INSTANCE_URL=https://git.fabledsword.com
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${RUNNER_TOKEN}
+      - GITEA_RUNNER_NAME=forgejo-host-runner
+      # Labels control which `runs-on:` values this runner accepts.
+      # ubuntu-latest is the label used in all workflow files.
+      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://node:20-bullseye,ubuntu-22.04:docker://node:20-bullseye
+      - CONFIG_FILE=/data/config.yml
+    volumes:
+      # Host Docker socket — required for the build job (docker buildx).
+      - /var/run/docker.sock:/var/run/docker.sock
+      - act_runner_data:/data
+      # act_runner creates job containers as siblings on the host docker daemon.
+      # The config file (written below by the init container) tells act_runner
+      # which host paths job containers are allowed to mount.
+      # See the init service below for how config.yml is created.
+    networks:
+      - fabled_backend
+    depends_on:
+      - act_runner_init
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+
+  # One-shot container that writes the act_runner config file before the runner starts.
+  # Runs once, exits, and the runner service picks up /data/config.yml.
+  act_runner_init:
+    image: busybox
+    volumes:
+      - act_runner_data:/data
+    command: >
+      sh -c "
+        if [ ! -f /data/config.yml ]; then
+          cat > /data/config.yml << 'EOF'
+log:
+  level: info
+
+runner:
+  # How many jobs to run concurrently on this runner.
+  capacity: 2
+  # Timeout for each job.
+  timeout: 30m
+
+cache:
+  enabled: true
+  dir: /data/.cache
+
+container:
+  # Job containers are created on the host Docker daemon (via mounted socket).
+  # They share the host network so they can reach Forgejo and the registry directly.
+  network: host
+  # Paths the runner is allowed to bind-mount into job containers.
+  # Add any paths here that workflow steps need to access on the host.
+  valid_volumes:
+    - /var/run/docker.sock
+EOF
+          echo 'config.yml written'
+        else
+          echo 'config.yml already exists, skipping'
+        fi
+      "
+    deploy:
+      restart_policy:
+        condition: none