Add CI/CD pipeline with Gitea Actions and production deployment

- Production Dockerfiles: backend (gunicorn + uvicorn workers),
  frontend (multi-stage Node build + nginx with API proxy)
- docker-compose.prod.yml: integrates with VPS nginx-proxy via
  VIRTUAL_HOST for auto-TLS at fit.cescalante.dev
- GitHub Actions workflow (Gitea Actions-compatible): builds images
  and deploys on push to main via self-hosted runner
- Make CORS origins configurable via CORS_ORIGINS env var

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.prod.yml

@@ -0,0 +1,82 @@
+services:
+  db:
+    image: pgvector/pgvector:pg16
+    container_name: healthyfit-db-prod
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    networks:
+      - healthyfit-network
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  backend:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile.prod
+    container_name: healthyfit-backend-prod
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
+      OPENAI_API_KEY: ${OPENAI_API_KEY}
+      SECRET_KEY: ${SECRET_KEY}
+      CORS_ORIGINS: ${CORS_ORIGINS}
+      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
+      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
+      VAPID_MAILTO: ${VAPID_MAILTO}
+    expose:
+      - "8000"
+    networks:
+      - healthyfit-network
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/')"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  frontend:
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile.prod
+      args:
+        VITE_API_URL: ${VITE_API_URL}
+    container_name: healthyfit-frontend-prod
+    restart: unless-stopped
+    environment:
+      VIRTUAL_HOST: fit.cescalante.dev
+      LETSENCRYPT_HOST: fit.cescalante.dev
+      LETSENCRYPT_EMAIL: cescalante2988@gmail.com
+    expose:
+      - "80"
+    networks:
+      - healthyfit-network
+      - nginx-prod-network
+    depends_on:
+      - backend
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+networks:
+  healthyfit-network:
+    driver: bridge
+    name: healthyfit-network-prod
+  nginx-prod-network:
+    external: true
+
+volumes:
+  postgres_data:
+    name: healthyfit-postgres-prod-data