ci: GitLab-Pipeline - build_embedded + manueller npm-Publish nach rohana (threadnet-call#1)

Registry-Entscheidung evidenzbasiert: das Package ist pnpm-Dependency von
ThreadNet-Webs apps/web, der Lockfile pinnt die Tarball-URL auf rohana -
Registry bleibt dort. Publish-Auth ueber CI-Variable GITEA_NPM_TOKEN statt
lokaler Klartext-.npmrc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

config/nginx.conf

@@ -0,0 +1,23 @@
+server {
+    listen       8080;
+    server_name  localhost;
+
+    root   /app;
+    gzip_static on;
+    gzip_vary on;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "public, max-age=30, stale-while-revalidate=30";
+    }
+
+    # assets can be cached because they have hashed filenames
+    location /assets {
+        add_header Cache-Control "public, immutable, max-age=31536000";
+    }
+
+    location /apple-app-site-association {
+        default_type application/json;
+    }
+}
+