ci: full CI/CD pipeline via Gitea Actions

Replaces the minimal CI workflow with a complete build/release pipeline:
- lint, typecheck, test (parallel, every push/PR)
- build: TS + completions + bun binaries + RPM packaging
- docker: build & push all 4 images (mcpd, node-runner, python-runner, docmost-mcp)
- publish-rpm: upload RPM to Gitea packages
- deploy: update Portainer stack

Also adds scripts/link-package.sh shared helper to auto-link packages
to the repository (Gitea 1.24+ API with graceful fallback), called from
all build/publish scripts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/link-package.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Link a Gitea package to a repository.
+# Works automatically on Gitea 1.24+ (uses API), warns on older versions.
+#
+# Usage: source scripts/link-package.sh
+#        link_package <type> <name>
+#
+# Requires: GITEA_URL, GITEA_TOKEN, GITEA_OWNER, GITEA_REPO
+
+link_package() {
+  local PKG_TYPE="$1"  # e.g. "rpm", "container"
+  local PKG_NAME="$2"  # e.g. "mcpctl", "mcpd"
+
+  if [ -z "$PKG_TYPE" ] || [ -z "$PKG_NAME" ]; then
+    echo "Usage: link_package <type> <name>"
+    return 1
+  fi
+
+  local GITEA_URL="${GITEA_URL:-http://10.0.0.194:3012}"
+  local GITEA_OWNER="${GITEA_OWNER:-michal}"
+  local GITEA_REPO="${GITEA_REPO:-mcpctl}"
+
+  if [ -z "$GITEA_TOKEN" ]; then
+    echo "WARNING: GITEA_TOKEN not set, skipping package-repo linking."
+    return 0
+  fi
+
+  # Check if already linked (search all packages, filter by type+name client-side)
+  local REPO_LINK
+  REPO_LINK=$(curl -s -H "Authorization: token ${GITEA_TOKEN}" \
+    "${GITEA_URL}/api/v1/packages/${GITEA_OWNER}" \
+    | python3 -c "
+import json,sys
+for p in json.load(sys.stdin):
+    if p['type']=='$PKG_TYPE' and p['name']=='$PKG_NAME':
+        r=p.get('repository')
+        if r: print(r['full_name'])
+        break
+" 2>/dev/null)
+
+  if [ -n "$REPO_LINK" ]; then
+    echo "==> Package ${PKG_TYPE}/${PKG_NAME} already linked to ${REPO_LINK}"
+    return 0
+  fi
+
+  # Try Gitea 1.24+ link API
+  local HTTP_CODE
+  HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    "${GITEA_URL}/api/v1/packages/${GITEA_OWNER}/${PKG_TYPE}/${PKG_NAME}/-/link/${GITEA_REPO}")
+
+  if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
+    echo "==> Linked ${PKG_TYPE}/${PKG_NAME} to ${GITEA_OWNER}/${GITEA_REPO}"
+    return 0
+  fi
+
+  # API not available (Gitea < 1.24) — warn with manual instructions
+  echo ""
+  echo "WARNING: Could not auto-link ${PKG_TYPE}/${PKG_NAME} to repository (Gitea < 1.24)."
+  echo "Link it manually in the Gitea UI:"
+  echo "  ${GITEA_URL}/${GITEA_OWNER}/-/packages/${PKG_TYPE}/${PKG_NAME}/settings"
+  echo "  -> Link to repository: ${GITEA_OWNER}/${GITEA_REPO}"
+  return 0
+}