ci: build QA in Portainer from a git stack, drop the build workflow

The QA image is now built by Portainer from this repository rather than
by Gitea Actions. Deployed as a Git repository stack, "Pull and redeploy"
pulls the repo, builds from the Dockerfile, and recreates the containers
in one action.

This removes the runner from the loop entirely. Three dispatches failed
without ever building: the runner refuses privileged containers, so the
dind service was never created. Working around that needed either the
host Docker socket mounted into the runner or privileged containers
enabled runner-wide, and both hand every workflow on every branch
root-equivalent control of the NAS, production included. Portainer
already holds the socket — that is how it manages containers — so
building there needs no new privilege at all.

pull_policy: build is what keeps it honest. Without it the stack reuses
whatever is tagged redefined-designs:qa, which is exactly how a redeploy
appears to succeed while still serving old code — a failure this project
has already hit twice.

Deleting qa-build.yml also drops the registry, the REGISTRY_TOKEN and
BREVO_API_KEY secrets, and the notification email. The email existed
because CI worked asynchronously and had to tell you when it finished;
redeploying from Portainer is synchronous, so the browser already does.
Losing the per-commit image tags is a real cost — rollback becomes
"rebuild from the ref you want" rather than retagging a specific build.

README changes for this are deliberately not in this commit: that file
also carries uncommitted work of Thom's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.qa.yml

@@ -13,27 +13,39 @@
 # against each other — it would happily remove the production containers
 # because they are not declared in this file.
 #
-# Required stack environment variable:
+# DEPLOY THIS AS A GIT REPOSITORY STACK, not from the web editor.
+#
+#   Repository:   https://gitea.bermudalamb.synology.me/bermudalamb/redefined-designs
+#   Reference:    refs/heads/main
+#   Compose path: docker-compose.qa.yml
+#
+# The repository is public, so no credentials are needed. Portainer then does
+# the whole cycle from one button: it pulls the repo, builds the image from the
+# Dockerfile below, and recreates the containers. Nothing is built by hand on
+# the NAS, and no image has to be pushed anywhere first.
+#
+# `pull_policy: build` matters. Without it the stack reuses whatever is already
+# tagged redefined-designs:qa, which is how a redeploy can appear to succeed
+# while still running old code. Leave any Portainer option that re-pulls images
+# turned OFF — there is no registry to pull this image from.
+#
+# Required stack environment variables:
 #   QA_DB_PASSWORD  — deliberately not named DB_PASSWORD, so pasting the
 #                     production stack's variables here does nothing silently.
-#
-# The image comes from the Gitea container registry, built by the manual
-# "Build QA Image" workflow. Redeploy this stack with Portainer's
-# "Pull latest image" toggle ON, or it will keep running the image it already
-# has and the redeploy will appear to do nothing.
-#
-# Portainer needs registry credentials for gitea.bermudalamb.synology.me once
-# (Registries > Add registry, custom, with a Gitea token that has read:package).
-#
-# This replaced a locally-built `redefined-designs:qa` with `pull_policy: never`.
-# That arrangement meant the image existed only if someone had remembered to
-# build it, which produced two confusing deploy failures: a "pull access denied"
-# from Docker Hub when the tag was missing entirely, and a silent stale-image
-# deploy when the build had not been rerun.
+#   PUBLIC_URL      — the QA hostname, e.g.
+#                     https://qa-redefined-designs.bermudalamb.synology.me
 
 services:
   redefined-designs-qa:
-    image: gitea.bermudalamb.synology.me/bermudalamb/redefined-designs:qa
+    # Built from this repository by Portainer rather than pulled. The context is
+    # the repo root, which is where the Dockerfile lives — the same Dockerfile
+    # production uses, so QA and production images differ only in configuration.
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: redefined-designs:qa
+    # Always build; never reuse the existing tag.
+    pull_policy: build
     container_name: redefined-designs-qa-syn
     environment:
       - TZ=America/Chicago
@@ -57,7 +69,7 @@ services:
       # a fixture ever contains a real address.
       - SITE_CURRENCY=USD
       - RESERVATION_MINUTES=15
-      - PUBLIC_URL=https://qa-redefined-designs.bermudalamb.synology.me
+      - PUBLIC_URL=${PUBLIC_URL}
     volumes:
       # Separate uploads directory. Sharing production's would let a QA run
       # write into, and a QA teardown delete, real product images.