ci: lockfile check, gitleaks, docker smoke job, renovate, shipped nginx security headers

- "Verify lockfile is in sync" (git diff --exit-code package-lock.json
  after npm ci) replaces the deleted GitHub lockfile workflow (#99).
- gitleaks 8.30.1 binary scan on push + PR with a small allowlist for
  the public homeserver/registry URLs (#95).
- docker job builds the image, runs it and asserts 200 + the security
  headers; continue-on-error until the runner is confirmed to have a
  Docker daemon (#93). .dockerignore keeps the context small.
- docker-nginx.conf now sends a CSP (frame-src allowlist matching
  videoEmbed.ts), frame-ancestors 'none', Referrer-Policy and nosniff —
  shipped config, verify against the live chat.lotusguild.org headers
  before adopting in prod nginx (#95, #44 shipped-config half).
- renovate.json + weekly renovate workflow for cinny and element-call;
  needs a RENOVATE_TOKEN secret (names starting GITEA_ are reserved) and
  stays continue-on-error until it exists (#94).
- e2e job appended for the Playwright smoke test (#90), continue-on-error
  until green on the runner.

Fixes #93
Fixes #94
Fixes #95

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

renovate.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "schedule": ["before 6am on monday"],
+  "packageRules": [
+    {
+      "matchPackagePatterns": ["^matrix-js-sdk"],
+      "groupName": "matrix-js-sdk"
+    },
+    {
+      "matchPackagePatterns": ["^@lotusguild/"],
+      "groupName": "@lotusguild packages"
+    },
+    {
+      "matchPackageNames": ["@lotusguild/element-call-embedded"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
+    },
+    {
+      "matchCategories": ["security"],
+      "groupName": "security updates",
+      "automerge": false
+    }
+  ]
+}