feat: static sites feature with Gitea/GitHub/GitLab support and Deno backend

Deploy static content from Git repository folders with optional server-side
API endpoints. Supports Gitea/Forgejo/Gogs, GitHub, and GitLab with provider
autodetection.

- New Sites entity with CRUD, encrypted secrets, and manual/push/tag sync triggers
- Pluggable GitProvider interface with three implementations
- Deno container mode: auto-generates router from API_{method}_{name} exports
- Static container mode: nginx serving files with optional markdown rendering
- Wizard UI with provider selector, repo picker, branch/folder tree pickers
- Deploy pipeline builds fresh image, starts container, configures NPM proxy
- Stop/Start buttons, force redeploy on manual trigger
- Periodic health checker detects crashed containers
- Proxy route existence check during auto-sync

internal/store/store.go

@@ -123,6 +123,8 @@ func (s *Store) runMigrations() error {
 		`ALTER TABLE settings ADD COLUMN public_ip TEXT NOT NULL DEFAULT ''`,
 		// Image prune threshold (MB). Warn on dashboard when exceeded. 0 = disabled.
 		`ALTER TABLE settings ADD COLUMN image_prune_threshold_mb INTEGER NOT NULL DEFAULT 1024`,
+		// Add provider column to static_sites (2026-04-11).
+		`ALTER TABLE static_sites ADD COLUMN provider TEXT NOT NULL DEFAULT ''`,
 	}
 
 	for _, m := range migrations {
@@ -144,6 +146,7 @@ func (s *Store) runMigrations() error {
 		`CREATE INDEX IF NOT EXISTS idx_event_log_source ON event_log(source)`,
 		`CREATE INDEX IF NOT EXISTS idx_event_log_created_at ON event_log(created_at)`,
 		`CREATE INDEX IF NOT EXISTS idx_dns_records_consumer ON dns_records(consumer_type, consumer_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_static_site_secrets_site_id ON static_site_secrets(site_id)`,
 	}
 	for _, idx := range indexes {
 		if _, err := s.db.Exec(idx); err != nil {
@@ -361,6 +364,42 @@ CREATE TABLE IF NOT EXISTS backups (
 	backup_type TEXT NOT NULL DEFAULT 'manual',
 	created_at  TEXT NOT NULL DEFAULT (datetime('now'))
 );
+
+CREATE TABLE IF NOT EXISTS static_sites (
+	id               TEXT PRIMARY KEY,
+	name             TEXT NOT NULL UNIQUE,
+	provider         TEXT NOT NULL DEFAULT '',
+	gitea_url        TEXT NOT NULL DEFAULT '',
+	repo_owner       TEXT NOT NULL DEFAULT '',
+	repo_name        TEXT NOT NULL DEFAULT '',
+	branch           TEXT NOT NULL DEFAULT 'main',
+	folder_path      TEXT NOT NULL DEFAULT '',
+	access_token     TEXT NOT NULL DEFAULT '',
+	domain           TEXT NOT NULL DEFAULT '',
+	mode             TEXT NOT NULL DEFAULT 'static',
+	render_markdown  INTEGER NOT NULL DEFAULT 0,
+	sync_trigger     TEXT NOT NULL DEFAULT 'manual',
+	tag_pattern      TEXT NOT NULL DEFAULT '',
+	container_id     TEXT NOT NULL DEFAULT '',
+	proxy_route_id   TEXT NOT NULL DEFAULT '',
+	status           TEXT NOT NULL DEFAULT 'idle',
+	last_sync_at     TEXT NOT NULL DEFAULT '',
+	last_commit_sha  TEXT NOT NULL DEFAULT '',
+	error            TEXT NOT NULL DEFAULT '',
+	created_at       TEXT NOT NULL DEFAULT (datetime('now')),
+	updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS static_site_secrets (
+	id         TEXT PRIMARY KEY,
+	site_id    TEXT NOT NULL REFERENCES static_sites(id) ON DELETE CASCADE,
+	key        TEXT NOT NULL,
+	value      TEXT NOT NULL DEFAULT '',
+	encrypted  INTEGER NOT NULL DEFAULT 0,
+	created_at TEXT NOT NULL DEFAULT (datetime('now')),
+	updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+	UNIQUE(site_id, key)
+);
 `
 
 // Now returns the current time formatted for SQLite storage.