ci: deploy Hugo blog to k3s via Podman + k8s API

- Use Podman (daemonless) instead of Docker for building images
- kubeconfig stored as Gitea secret KUBECONFIG_B64
- RBAC: hugo-deployer SA for k8s API access
- Gitea Registry enabled for container storage

deploy/deploy.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# hugo-blog deploy script
+# Runs on UC server: git pull -> hugo -> docker build+push -> kubectl rollout
+set -euo pipefail
+
+REPO_DIR="/root/hugo-blog"
+REGISTRY="git.luochen570.cn"
+IMAGE="luochen570/hugo-blog"
+NAMESPACE="hugo"
+DEPLOYMENT="hugo-blog"
+
+cd "$REPO_DIR"
+
+# 1. Pull latest
+echo "=== Pull latest ==="
+git fetch origin main
+LOCAL=$(git rev-parse HEAD)
+REMOTE=$(git rev-parse origin/main)
+if [ "$LOCAL" = "$REMOTE" ]; then
+  echo "Already up to date ($LOCAL). Nothing to do."
+  exit 0
+fi
+git merge --ff-only origin/main
+
+SHA=$(git rev-parse --short HEAD)
+echo "New commit: $SHA"
+
+# 2. Hugo build
+echo "=== Hugo build ==="
+hugo --minify -d public/
+
+# 3. Docker build and push
+echo "=== Docker build ==="
+docker build -t $REGISTRY/$IMAGE:$SHA -t $REGISTRY/$IMAGE:latest .
+
+echo "=== Docker push ==="
+docker login $REGISTRY -u luochen570 --password-stdin < ~/.config/gitea/token
+docker push $REGISTRY/$IMAGE:$SHA
+docker push $REGISTRY/$IMAGE:latest
+
+# 4. Deploy to k3s
+echo "=== k3s rollout ==="
+kubectl set image deployment/$DEPLOYMENT -n $NAMESPACE \
+  nginx=$REGISTRY/$IMAGE:$SHA
+kubectl rollout status deployment/$DEPLOYMENT -n $NAMESPACE --timeout=120s
+
+echo "=== Done: $SHA ==="