feat(gitops): config-as-code via .tinyforge.yml for repo-backed workloads

A dockerfile or static workload can opt in to reading its deploy config from a
.tinyforge.yml in its own repo. Tinyforge fetches the file, shows field-level
drift vs the live config, and an admin applies it with an explicit Sync. The
repo becomes the source of truth for the declared fields. Manual-sync only;
no auto-apply on deploy, no multi-workload reconcile, no create/delete in v1.

Scope is deliberately source-aware and source_config-resident: dockerfile
declares port/healthcheck/deploy_strategy, static declares deploy_strategy.
The file never carries repo coords or secrets (those stay in the encrypted
DB), which keeps credentials out of the repo.

Backend:
- internal/gitops: Spec/ParseSpec (KnownFields rejects unknown keys), a
  source-aware ApplyPlan/BuildPlan, MergeAndValidate (omitted-field-preserving
  deep merge + validate-the-merged-result-then-commit — never a partial
  config), declared-only Drift with normalization, and Fetch with
  ok/no_file/fetch_failed/invalid statuses and token-redacted messages.
- staticsite: DownloadFile added to GitProvider + Gitea/GitHub/GitLab impls,
  reusing each provider's SSRF-safe client; 64 KiB cap; ErrFileNotFound.
- store: 4 additive gitops_* columns + setters (disjoint from UpdateWorkload
  so the edit-form save and a sync never clobber each other).
- api: GET /workloads/{id}/gitops (status + raw + live drift + managed_fields),
  PUT /gitops (admin, enable/path, traversal-safe), POST /gitops/sync (admin,
  per-workload locked read->merge->validate->write, audited to event_log).

Frontend:
- GitOpsPanel.svelte: status pill, a purpose-built field-level drift view,
  .tinyforge.yml preview, enable ToggleSwitch, Sync via ConfirmDialog; all five
  statuses handled, admin affordances gated on the real viewer role.
- GitOps-managed badge (list + detail hero) and a read-only edit-form banner.
- api.ts fetchers + types; i18n apps.detail.gitops.* (en + ru parity).

Built phase-by-phase with an adversarial plan review (caught 5 design flaws
pre-implementation) and an independent review per phase (go / security / ts /
final) — all APPROVE, 0 CRITICAL/HIGH. docs/gitops.md documents the schema and
what's intentionally out of v1. Plan: plans/gitops/.

internal/staticsite/commit_status_reporter_test.go

@@ -44,6 +44,9 @@ func (*fakeReporterProvider) ListTree(context.Context, string, string, string) (
 func (*fakeReporterProvider) DownloadFolder(context.Context, string, string, string, string, string) error {
 	panic("unused")
 }
+func (*fakeReporterProvider) DownloadFile(context.Context, string, string, string, string, int64) ([]byte, error) {
+	panic("unused")
+}
 
 // Enabled: forwards to the provider with the captured identifiers + target.
 func TestCommitStatusReporter_Enabled_Calls(t *testing.T) {

internal/staticsite/gitea_content.go

@@ -295,6 +295,15 @@ func (f *GiteaContentFetcher) DownloadFolder(ctx context.Context, owner, repo, b
 	return nil
 }
 
+// DownloadFile fetches a single file's raw bytes via Gitea's raw endpoint
+// (also serves Forgejo/Gogs), capped at maxBytes. Returns ErrFileNotFound on
+// a 404 so an absent config file reads as a non-error state.
+func (f *GiteaContentFetcher) DownloadFile(ctx context.Context, owner, repo, ref, path string, maxBytes int64) ([]byte, error) {
+	p := strings.TrimPrefix(path, "/")
+	fileURL := fmt.Sprintf("%s/api/v1/repos/%s/%s/raw/%s?ref=%s", f.baseURL, owner, repo, p, ref)
+	return getFileBytes(ctx, f.httpClient, fileURL, maxBytes, f.setAuth)
+}
+
 // TestConnection verifies that the repository is accessible.
 func (f *GiteaContentFetcher) TestConnection(ctx context.Context, owner, repo string) error {
 	url := fmt.Sprintf("%s/api/v1/repos/%s/%s", f.baseURL, owner, repo)

internal/staticsite/github_provider.go

@@ -288,6 +288,19 @@ func (g *GitHubProvider) DownloadFolder(ctx context.Context, owner, repo, branch
 	return nil
 }
 
+// DownloadFile fetches a single file's raw bytes via the GitHub contents API
+// using the raw media type (works for both github.com and GHE), capped at
+// maxBytes. Returns ErrFileNotFound on a 404.
+func (g *GitHubProvider) DownloadFile(ctx context.Context, owner, repo, ref, path string, maxBytes int64) ([]byte, error) {
+	p := strings.TrimPrefix(path, "/")
+	fileURL := fmt.Sprintf("%s/repos/%s/%s/contents/%s?ref=%s", g.apiBase, owner, repo, p, ref)
+	auth := func(r *http.Request) {
+		g.setAuth(r)
+		r.Header.Set("Accept", "application/vnd.github.raw+json")
+	}
+	return getFileBytes(ctx, g.httpClient, fileURL, maxBytes, auth)
+}
+
 func (g *GitHubProvider) doGet(ctx context.Context, url string) ([]byte, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {

internal/staticsite/gitlab_provider.go

@@ -273,6 +273,22 @@ func (g *GitLabProvider) DownloadFolder(ctx context.Context, owner, repo, branch
 	return nil
 }
 
+// DownloadFile fetches a single file's raw bytes via GitLab's raw endpoint,
+// capped at maxBytes. Returns ErrFileNotFound on a 404. owner/repo/ref are
+// path-escaped; the file path is passed through verbatim to preserve its `/`
+// separators (a `..` segment is harmless — the bytes are only parsed in
+// memory, never written to disk, so there is no local-traversal sink).
+func (g *GitLabProvider) DownloadFile(ctx context.Context, owner, repo, ref, path string, maxBytes int64) ([]byte, error) {
+	p := strings.TrimPrefix(path, "/")
+	fileURL := fmt.Sprintf("%s/%s/%s/-/raw/%s/%s",
+		g.rawBase,
+		url.PathEscape(owner),
+		url.PathEscape(repo),
+		url.PathEscape(ref),
+		p)
+	return getFileBytes(ctx, g.httpClient, fileURL, maxBytes, g.setAuth)
+}
+
 func (g *GitLabProvider) doGet(ctx context.Context, apiURL string) ([]byte, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, apiURL, nil)
 	if err != nil {

internal/staticsite/provider.go

@@ -3,6 +3,7 @@ package staticsite
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -12,6 +13,11 @@ import (
 	"time"
 )
 
+// ErrFileNotFound is returned by GitProvider.DownloadFile when the file is
+// absent (HTTP 404). Callers use it to distinguish "no file" (a normal,
+// non-error state for GitOps) from a genuine fetch failure.
+var ErrFileNotFound = errors.New("file not found")
+
 // RepoInfo represents a repository returned by the provider's list/search API.
 type RepoInfo struct {
 	Owner       string `json:"owner"`
@@ -81,6 +87,12 @@ type GitProvider interface {
 	// DownloadFolder downloads all files from a folder path to a local directory.
 	DownloadFolder(ctx context.Context, owner, repo, branch, folderPath, destDir string) error
 
+	// DownloadFile fetches a single file's bytes from a ref (branch/sha),
+	// capped at maxBytes. Returns ErrFileNotFound on a 404 so callers can
+	// treat an absent file as a non-error state. Used to read a small in-repo
+	// config file (e.g. .tinyforge.yml) without materializing a whole tree.
+	DownloadFile(ctx context.Context, owner, repo, ref, path string, maxBytes int64) ([]byte, error)
+
 	// SetCommitStatus reports a deploy status on a commit. Best-effort;
 	// callers ignore errors beyond logging. targetURL and description are
 	// optional (pass "" to omit); description is truncated to a provider-
@@ -206,6 +218,44 @@ func postJSON(ctx context.Context, client *http.Client, url string, body []byte,
 	return nil
 }
 
+// getFileBytes GETs fileURL with the caller's auth applied and returns the
+// body, enforcing a maxBytes cap. Returns ErrFileNotFound on 404; a
+// status-code-only error otherwise (it must NOT echo the response body — a
+// hostile/misconfigured provider could reflect the request's auth token back).
+func getFileBytes(ctx context.Context, client *http.Client, fileURL string, maxBytes int64, authHeader func(r *http.Request)) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fileURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+	if authHeader != nil {
+		authHeader(req)
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("execute request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	switch {
+	case resp.StatusCode == http.StatusNotFound:
+		return nil, ErrFileNotFound
+	case resp.StatusCode != http.StatusOK:
+		return nil, fmt.Errorf("unexpected status %d", resp.StatusCode)
+	}
+
+	// Read one byte past the cap so an over-size file is detected rather than
+	// silently truncated.
+	data, err := io.ReadAll(io.LimitReader(resp.Body, maxBytes+1))
+	if err != nil {
+		return nil, fmt.Errorf("read response: %w", err)
+	}
+	if int64(len(data)) > maxBytes {
+		return nil, fmt.Errorf("file exceeds %d byte cap", maxBytes)
+	}
+	return data, nil
+}
+
 // downloadFileHTTP is a shared helper for downloading a file from a URL.
 func downloadFileHTTP(ctx context.Context, client *http.Client, url, localPath string, authHeader func(r *http.Request)) error {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)