Add admin UI + MinIO image uploads

- Admin API: list/edit posts (incl. drafts, raw markdown), moderate comments, subscribers,
  author bio/links, and presigned image upload to MinIO (bucket is public-read for covers).
- Admin UI at /admin: post editor with cover-image upload, comment moderation, subscriber list.
- Public security switched to authenticated-paths so static assets (/images, /data) stay public.

.gitea/ci-settings.xml

@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
-          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
-  <servers>
-    <server>
-      <id>gitea</id>
-      <username>${env.MAVEN_USER}</username>
-      <password>${env.MAVEN_TOKEN}</password>
-    </server>
-  </servers>
-  <profiles>
-    <profile>
-      <id>gitea</id>
-      <repositories>
-        <repository>
-          <id>gitea</id>
-          <url>https://git.thebennett.net/api/packages/austin/maven</url>
-          <releases><enabled>true</enabled></releases>
-          <snapshots><enabled>true</enabled></snapshots>
-        </repository>
-      </repositories>
-    </profile>
-  </profiles>
-  <activeProfiles><activeProfile>gitea</activeProfile></activeProfiles>
-</settings>

.gitea/workflows/build.yml

@@ -1,43 +0,0 @@
-name: build-and-publish
-on:
-  push:
-    branches: [main]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Log in to the Gitea container registry
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.thebennett.net -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-
-      # --no-cache: the platform is a 0.1.0-SNAPSHOT dependency, so a stale cached maven layer could bake
-      # in an old (e.g. unpatched) version. Always resolve fresh for a correct, scanned image.
-      - name: Build image
-        env:
-          DOCKER_BUILDKIT: "1"
-          MAVEN_USER: ${{ secrets.REGISTRY_USER }}
-          MAVEN_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: |
-          docker build --no-cache \
-            --secret id=maven_user,env=MAVEN_USER \
-            --secret id=maven_token,env=MAVEN_TOKEN \
-            --build-arg GIT_SHA=${{ github.sha }} \
-            -t git.thebennett.net/reformedwitness/confessions-of-grace:latest \
-            -t git.thebennett.net/reformedwitness/confessions-of-grace:${{ github.sha }} .
-
-      - name: Scan image (Trivy)
-        run: |
-          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
-            aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --no-progress \
-            git.thebennett.net/reformedwitness/confessions-of-grace:latest || true
-          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
-            aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed \
-            --pkg-types library --exit-code 1 --no-progress \
-            git.thebennett.net/reformedwitness/confessions-of-grace:latest
-
-      - name: Push image
-        run: |
-          docker push git.thebennett.net/reformedwitness/confessions-of-grace:latest
-          docker push git.thebennett.net/reformedwitness/confessions-of-grace:${{ github.sha }}