ci: lockfile check, gitleaks, docker smoke job, renovate, shipped nginx security headers

- "Verify lockfile is in sync" (git diff --exit-code package-lock.json
  after npm ci) replaces the deleted GitHub lockfile workflow (#99).
- gitleaks 8.30.1 binary scan on push + PR with a small allowlist for
  the public homeserver/registry URLs (#95).
- docker job builds the image, runs it and asserts 200 + the security
  headers; continue-on-error until the runner is confirmed to have a
  Docker daemon (#93). .dockerignore keeps the context small.
- docker-nginx.conf now sends a CSP (frame-src allowlist matching
  videoEmbed.ts), frame-ancestors 'none', Referrer-Policy and nosniff —
  shipped config, verify against the live chat.lotusguild.org headers
  before adopting in prod nginx (#95, #44 shipped-config half).
- renovate.json + weekly renovate workflow for cinny and element-call;
  needs a RENOVATE_TOKEN secret (names starting GITEA_ are reserved) and
  stays continue-on-error until it exists (#94).
- e2e job appended for the Playwright smoke test (#90), continue-on-error
  until green on the runner.

Fixes #93
Fixes #94
Fixes #95

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

.gitleaks.toml

@@ -0,0 +1,19 @@
+title = "gitleaks config for Lotus Chat (cinny fork)"
+
+# Gitea #95 — secret scanning was entirely absent. Extend gitleaks' built-in
+# ruleset (don't replace it) and allowlist the known-public infrastructure
+# URLs that show up in tracked config, which are hostnames, not secrets.
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Known-public Lotus/Matrix homeserver + npm registry URLs — not secrets"
+regexes = [
+  '''https?://matrix\.lotusguild\.org''',
+  '''https?://code\.lotusguild\.org/api/packages/LotusGuild/npm/''',
+  '''matrix\.lotusguild\.org''',
+]
+paths = [
+  '''config\.json''',
+  '''\.npmrc''',
+]