Add Soroush CI/CD (Gitea + Nexus) + self-host fonts for offline build

Pipeline (.gitea/workflows/ci-cd.yml), all images/packages via Nexus mirror:
- CI api-build: dotnet restore/build server/Hokm.slnx + run Hokm.Sim (rules).
- CI web-check: npm install + tsc --noEmit + next build (static export).
- deploy (self-hosted): pre-deploy pg_dump backup, rollback image tag, build,
  bring up db -> server -> web with stop+rm+up --no-deps (no force-recreate,
  no bare compose down), health-wait each, prune.

Local stack (docker-compose.yml), ports in 1500-1600 so it coexists with manual
dev on 3000/5005:  web :1500 (nginx static) -> server :1505 (.NET) -> db :1510
(postgres, named volume + backups). Dockerfiles: server (.NET, NuGet via
nuget.docker.config, binds 0.0.0.0, busybox wget healthcheck) + web (Next static
export -> nginx, NEXT_PUBLIC_* baked as build args). nginx.conf SPA fallback.

Config: server CORS is now config-driven (Cors__Origins) so the deployed web
origin is allowed without code edits. deploy/ENV_FILE.example documents the
Gitea ENV_FILE secret; DEPLOY.md covers setup/run/LAN-IP/rollback/migrations.

Fonts: switch Vazirmatn + Plus Jakarta Sans from next/font/google (build-time
Google fetch -> fails on the Iran CI runner) to self-hosted @fontsource-variable
packages. Build is offline and ~3x faster; 7 woff2 emitted into out/.

Verified locally: dotnet build slnx + Hokm.Sim (300 matches, exit 0); tsc clean;
next build clean with self-hosted fonts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,22 @@
+# Barg-e Vasat web (Next.js 16 static export → nginx)
+# The app is output:"export" (fully client-side), so we build the static `out/`
+# and serve it with nginx. NEXT_PUBLIC_* are baked at build time.
+FROM mirror.soroushasadi.com/node:20-alpine AS build
+WORKDIR /app
+COPY package*.json ./
+RUN npm install --legacy-peer-deps --ignore-scripts \
+      --registry https://mirror.soroushasadi.com/repository/npm-group/
+COPY . .
+# Live mode + the API origin the BROWSER will use (host-mapped port / LAN IP).
+ARG NEXT_PUBLIC_USE_SERVER=1
+ARG NEXT_PUBLIC_SERVER_URL=http://localhost:1505
+ENV NEXT_PUBLIC_USE_SERVER=$NEXT_PUBLIC_USE_SERVER
+ENV NEXT_PUBLIC_SERVER_URL=$NEXT_PUBLIC_SERVER_URL
+RUN npm run build
+
+FROM mirror.soroushasadi.com/nginx:alpine
+COPY --from=build /app/out /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80
+HEALTHCHECK --interval=10s --timeout=5s --retries=6 --start-period=10s \
+  CMD wget -q -O- http://127.0.0.1/ || exit 1