feat: SPA routing, projects/resume sections, deployment infra

- Add client-side router with History API pushState (router.ts, pages.ts)
- Extend overlay with projects grid/category/detail views and resume section
- Add Gitea CI/CD workflow and webhook deployment server
- Improve Docker Compose with nginx reverse proxy config
- Add deployment script and .env.example

AGENTS.md

@@ -325,4 +325,82 @@ renderer.updateText(layout)
 ```
 
 Font files go in `public/` and are fetched at runtime. Uses `opentype.js` (runtime
-dep) + `@types/opentype.js` (dev dep).
+dep) + `@types/opentype.js` (dev dep).
+
+## Deployment (Docker + nginx + webhook CI/CD)
+
+The stack runs in Docker Compose with two containers on a shared internal network:
+
+| Container           | Role                                    | Port exposed |
+|---------------------|-----------------------------------------|--------------|
+| `webgpu-portfolio-web`    | App: nginx serving the built dist/      | internal:80  |
+| `webgpu-portfolio-nginx`  | Reverse proxy in front of web           | host:80      |
+
+- `nginx/reverse.conf` — reverse proxy config, routes `djosen.one` → `web:80`
+- `nginx.default.conf` — internal nginx config in the app container (SPA, gzip, caching)
+- `docker-compose.yml` — full stack, health checks, auto-restart
+- `.dockerignore` — excludes node_modules, dist, git, and CI files from the build context
+
+### CI/CD webhook
+
+A Python stdlib webhook server (`webhook/server.py`) listens on port 9000, verifies
+Gitea's `X-Gitea-Signature` HMAC-SHA256, and on `push` events runs:
+
+```
+git pull origin master
+docker compose up -d --build --remove-orphans
+```
+
+Minimal downtime (~1–2 s) because only the `web` container is rebuilt; nginx-proxy
+stays running and buffers connections during the restart.
+
+### Setup on the server (first time)
+
+```bash
+# 1. Clone the repo
+git clone https://git.djosen.one/djoser/webgpu-portfolio /home/djoser/webgpu-portfolio
+cd /home/djoser/webgpu-portfolio
+
+# 2. Create .env with a webhook secret
+openssl rand -hex 32 > /tmp/secret
+echo "WEBHOOK_SECRET=$(cat /tmp/secret)" > .env
+echo "REPO_DIR=/home/djoser/webgpu-portfolio" >> .env
+
+# 3. Start the stack
+docker compose up -d
+
+# 4. Install & start the webhook service
+sudo cp webhook/webhook.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now webhook-webhook.service
+
+# 5. Configure Gitea webhook
+#    - Go to repo Settings → Webhooks → Add Webhook (Gitea)
+#    - Target URL:  http://<server-ip>:9000
+#    - Secret:      <content of /tmp/secret>
+#    - Events:      Push events
+#    - Active:      ✓
+```
+
+### Manual deploy (no webhook)
+
+```bash
+bash scripts/deploy.sh
+```
+
+### Verify everything is working
+
+```bash
+# Stack health
+docker compose ps
+curl -s http://localhost:80/health
+
+# Webhook health
+curl -s http://localhost:9000/health
+
+# Test webhook (simulate a push)
+curl -X POST http://localhost:9000/ \
+  -H "X-Gitea-Event: push" \
+  -H "X-Gitea-Signature: ..." \
+  -d '{"ref":"refs/heads/master"}'
+```