ci: lockfile check, gitleaks, docker smoke job, renovate, shipped nginx security headers

- "Verify lockfile is in sync" (git diff --exit-code package-lock.json
  after npm ci) replaces the deleted GitHub lockfile workflow (#99).
- gitleaks 8.30.1 binary scan on push + PR with a small allowlist for
  the public homeserver/registry URLs (#95).
- docker job builds the image, runs it and asserts 200 + the security
  headers; continue-on-error until the runner is confirmed to have a
  Docker daemon (#93). .dockerignore keeps the context small.
- docker-nginx.conf now sends a CSP (frame-src allowlist matching
  videoEmbed.ts), frame-ancestors 'none', Referrer-Policy and nosniff —
  shipped config, verify against the live chat.lotusguild.org headers
  before adopting in prod nginx (#95, #44 shipped-config half).
- renovate.json + weekly renovate workflow for cinny and element-call;
  needs a RENOVATE_TOKEN secret (names starting GITEA_ are reserved) and
  stays continue-on-error until it exists (#94).
- e2e job appended for the Playwright smoke test (#90), continue-on-error
  until green on the runner.

Fixes #93
Fixes #94
Fixes #95

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

.gitea/workflows/renovate.yml

@@ -0,0 +1,28 @@
+name: Renovate
+
+# Gitea #94 — no dependency update automation existed at all. Runs the
+# official renovate/renovate Docker image against this Gitea instance.
+#
+# Requires a `RENOVATE_TOKEN` repo/org secret: a Gitea access token with
+# read/write on LotusGuild/cinny and LotusGuild/element-call, created by a
+# maintainer — this workflow does not (and cannot) create one for you.
+# Note: Gitea reserves the `GITEA_` secret-name prefix, so the token cannot
+# be named e.g. `GITEA_TOKEN` — hence `RENOVATE_TOKEN`.
+on:
+  schedule:
+    - cron: '0 4 * * 1' # weekly, Monday 04:00 UTC
+  workflow_dispatch: {}
+
+jobs:
+  renovate:
+    name: Renovate
+    runs-on: ubuntu-latest
+    continue-on-error: true # informational until RENOVATE_TOKEN is confirmed present
+    steps:
+      - name: Run Renovate
+        uses: docker://renovate/renovate:44
+        env:
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: https://code.lotusguild.org/api/v1
+          RENOVATE_REPOSITORIES: LotusGuild/cinny,LotusGuild/element-call