fix(ci): use github.server_url template expression instead of missing GITEA_SERVER_URL env

Pipeline includes lint (eslint), build (tsc + vite), and manual
deploy stages.

.gitea/SETUP.md

@@ -0,0 +1,49 @@
+# Gitea CI/CD — Setup Checklist
+
+After pushing, the pipeline will run automatically. The following steps are required to unlock all features (especially deploy jobs).
+
+## 1. Repository Secrets (Settings → Actions → Secrets)
+
+| Secret Name | Description |
+|---|---|
+| `SSH_PASSWORD` | SSH password for the deployment server |
+| `SSH_USER` | SSH username for the deployment server |
+| `SSH_HOST` | IP or domain of the deployment server |
+
+## 2. Repository Variables (Settings → Actions → Variables)
+
+| Variable Name | Default | Description |
+|---|---|---|
+| `SSH_PORT` | `22` | SSH port for the deployment server |
+| `SSH_TARGET_DIR` | — | Absolute path on the server where `dist/` contents should be placed |
+| `PRODUCTION_URL` | — | Public URL of the production site |
+| `VITE_API_ORIGIN` | — | (Optional) API base URL passed at build time |
+
+## 3. Allow Gitea Actions
+
+- Go to **Settings → Actions** in your Gitea repository
+- Ensure **"Actions"** are enabled
+- If using self-hosted runners, ensure a runner is registered and online
+
+## 4. Optional: Configure Gitea Actions Runner
+
+If no runner is registered yet on your Gitea instance:
+
+```bash
+# On the runner machine (Docker-based)
+docker run -d \
+  --name gitea-runner \
+  -e GITEA_INSTANCE_URL=https://192.168.3.80 \
+  -e GITEA_RUNNER_REGISTRATION_TOKEN=<your-registration-token> \
+  -e GITEA_RUNNER_NAME=runner-1 \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  gitea/act_runner:latest
+```
+
+## Pipeline Stages
+
+| Job | Requires Secrets/Vars | Runs on |
+|---|---|---|
+| `lint` | None | Push & PR |
+| `build` | None | Push & PR |
+| `deploy` | SSH secrets + vars | Manual on `develop` |

.gitea/workflows/build.yml

@@ -0,0 +1,153 @@
+# Gitea CI/CD for alrahma_web_client (React + Vite + TypeScript)
+#
+# Triggers:
+#   - Push to any branch
+#   - Pull requests
+#   - Tags
+#
+# Stages: lint → build → deploy (manual)
+
+name: Web Client CI/CD
+
+on:
+  push:
+    branches: [main, master, develop, 'feature/**', 'fix/**']
+    tags: ['v*']
+  pull_request:
+    branches: [main, master, develop]
+
+env:
+  CI: true
+
+jobs:
+  # ──────────────────────────────────────────────
+  #  LINT: ESLint with TypeScript
+  # ──────────────────────────────────────────────
+  lint:
+    name: Lint (ESLint + TypeScript)
+    runs-on: ubuntu-latest
+    container:
+      image: node:22-alpine
+    steps:
+      - name: Checkout repository
+        env:
+          GIT_SSL_NO_VERIFY: "1"
+        run: |
+          apk add --no-cache git
+          SERVER="${{ github.server_url }}"
+          REPO="${{ github.repository }}"
+          TOKEN="${{ github.token }}"
+          git clone --depth 1 \
+            "https://x-access-token:${TOKEN}@${SERVER#https://}/${REPO}.git" \
+            .
+          git fetch --depth 1 origin "${{ github.sha }}"
+          git checkout "${{ github.sha }}"
+        shell: sh
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: node_modules/
+          key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: npm ci --no-audit --no-fund
+
+      - name: Run ESLint
+        run: npm run lint
+
+  # ──────────────────────────────────────────────
+  #  BUILD: TypeScript + Vite
+  # ──────────────────────────────────────────────
+  build:
+    name: Build (tsc + Vite)
+    runs-on: ubuntu-latest
+    container:
+      image: node:22-alpine
+    steps:
+      - name: Checkout repository
+        env:
+          GIT_SSL_NO_VERIFY: "1"
+        run: |
+          apk add --no-cache git
+          SERVER="${{ github.server_url }}"
+          REPO="${{ github.repository }}"
+          TOKEN="${{ github.token }}"
+          git clone --depth 1 \
+            "https://x-access-token:${TOKEN}@${SERVER#https://}/${REPO}.git" \
+            .
+          git fetch --depth 1 origin "${{ github.sha }}"
+          git checkout "${{ github.sha }}"
+        shell: sh
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: node_modules/
+          key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: npm ci --no-audit --no-fund
+
+      - name: Build project
+        run: npm run build
+        env:
+          VITE_API_ORIGIN: ${{ vars.VITE_API_ORIGIN || '' }}
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+  # ──────────────────────────────────────────────
+  #  DEPLOY (manual): to shared hosting via SSH
+  # ──────────────────────────────────────────────
+  deploy:
+    name: Deploy to shared hosting
+    runs-on: ubuntu-latest
+    container:
+      image: alpine:3.20
+    if: github.ref == 'refs/heads/develop'
+    needs: [lint, build]
+    environment:
+      name: production
+      url: ${{ vars.PRODUCTION_URL }}
+    steps:
+      - name: Checkout repository
+        env:
+          GIT_SSL_NO_VERIFY: "1"
+        run: |
+          apk add --no-cache git
+          SERVER="${{ github.server_url }}"
+          REPO="${{ github.repository }}"
+          TOKEN="${{ github.token }}"
+          git clone --depth 1 \
+            "https://x-access-token:${TOKEN}@${SERVER#https://}/${REPO}.git" \
+            .
+          git fetch --depth 1 origin "${{ github.sha }}"
+          git checkout "${{ github.sha }}"
+        shell: sh
+
+      - name: Install SSH and rsync
+        run: |
+          apk add --no-cache openssh-client sshpass rsync
+
+      - name: Download built artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Deploy built files to shared hosting
+        run: |
+          sshpass -p "${{ secrets.SSH_PASSWORD }}" rsync -avz --delete \
+            -e "ssh -p ${{ vars.SSH_PORT || 22 }} -o StrictHostKeyChecking=no" \
+            --exclude='.htaccess' \
+            ./dist/ \
+            ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:${{ vars.SSH_TARGET_DIR }}/