feat: SPA routing, projects/resume sections, deployment infra

- Add client-side router with History API pushState (router.ts, pages.ts)
- Extend overlay with projects grid/category/detail views and resume section
- Add Gitea CI/CD workflow and webhook deployment server
- Improve Docker Compose with nginx reverse proxy config
- Add deployment script and .env.example

nginx/reverse.conf

@@ -0,0 +1,44 @@
+# nginx reverse proxy — sits in front of the app container
+# This config is mounted into the nginx-proxy container in docker-compose.
+upstream app {
+    # Points to the web service by container name (docker DNS)
+    server web:8080;
+}
+
+server {
+    listen 80;
+    server_name djosen.one www.djosen.one;
+
+    # Proxy all requests to the app container
+    location / {
+        proxy_pass http://app;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket support (not currently used, but forward-looking)
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # Buffering: off for WebGPU/streaming, but on for static is fine.
+        # We serve static from the app container's nginx, so keep this simple.
+    }
+
+    # Health-check endpoint — used by the webhook deploy script to verify liveness
+    location /health {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok";
+    }
+
+    # Security
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Logs
+    access_log /var/log/nginx/access.log;
+    error_log  /var/log/nginx/error.log;
+}

nginx/system-default.conf

@@ -0,0 +1,75 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    server_name _;
+
+    root /var/www/html;
+    index index.html index.htm index.nginx-debian.html;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    location /valentine {
+        proxy_pass http://localhost:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_cache_bypass $http_upgrade;
+    }
+}
+server {
+    server_name djosen.one; # managed by Certbot
+
+    # SSL termination — Certbot managed
+    listen [::]:443 ssl ipv6only=on; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/djosen.one/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/djosen.one/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+    # valentine app (unchanged)
+    location /valentine {
+        proxy_pass http://localhost:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    # Health-check endpoint for deploy scripts
+    location /health {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok";
+    }
+
+    # Everything else → Docker portfolio container
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
+server {
+    if ($host = djosen.one) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80 ;
+    listen [::]:80 ;
+    server_name djosen.one;
+    return 404; # managed by Certbot
+
+
+}