Simplify CI/CD for same-swarm topology: no SSH, direct service update

Since Forgejo and the app share a swarm, the runner can:
- Connect to Forgejo at http://forgejo:3000 (internal, no Traefik)
- Call docker service update directly via mounted socket
- Avoid SSH entirely — secrets drop from 6 to 3

infra/runner-swarm.yml: runner added to Forgejo stack, pinned to manager
  node (required for service API access), uses Docker Swarm Config object
  for act_runner config injection
infra/act-runner-config.yml: runner config (bridge network for jobs,
  docker socket whitelisted)
build.yml: deploy step replaced with docker service update --with-registry-auth
  --detach=false (waits for rollout, shows progress in Actions log)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/act-runner-config.yml

@@ -0,0 +1,27 @@
+# act_runner configuration — stored as a Docker Swarm Config object.
+# Referenced in runner-swarm.yml under configs.act_runner_config.
+#
+# After changing this file, update the swarm config:
+#   docker config rm act_runner_config
+#   docker stack deploy -c forgejo-stack.yml forgejo  (or docker compose up -d)
+
+log:
+  level: info
+
+runner:
+  capacity: 2   # concurrent jobs
+  timeout: 30m
+
+cache:
+  enabled: true
+  dir: /data/.cache
+
+container:
+  # bridge: job containers get internet access via NAT but are isolated from
+  # each other and the swarm overlay. Sufficient for npm/pip/docker push.
+  network: bridge
+
+  # Whitelist of host paths that workflow steps are allowed to bind-mount.
+  # The Docker socket is required for the build and deploy jobs.
+  valid_volumes:
+    - /var/run/docker.sock