ci(deploy): auto-deploy to TrueNAS via self-hosted Gitea Actions runner

- Replace VPS SSH deploy workflow with a self-contained job that runs on the
  TrueNAS act_runner (host docker socket mounted). Checks out the pushed commit,
  builds, and rolls out the cannamanage compose stack in-place (project=cannamanage),
  then health-checks backend :8081 + frontend :3000.
- Commit docker-compose.truenas.yml (port remap 8081 + AUTH_SECRET) into the repo;
  it was previously host-only, so a fresh checkout could not reproduce the deploy.
  Use the !override tag for the backend ports list.

docker-compose.truenas.yml

@@ -0,0 +1,20 @@
+# TrueNAS homelab override — replaces localhost with 192.168.188.119
+# Applied on top of docker-compose.yml for the homelab deployment on TrueNAS.local.
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.truenas.yml up -d --build
+services:
+  backend:
+    # Host port 8080 is taken by odysseus-searxng-1; remap to 8081.
+    # !override replaces the inherited ports list (compose merges lists by concat otherwise).
+    # Internal container port stays 8080 so frontend's BACKEND_URL=http://backend:8080 is unaffected.
+    ports: !override
+      - "8081:8080"
+
+  frontend:
+    environment:
+      NEXTAUTH_URL: http://192.168.188.119:3000
+      AUTH_URL: http://192.168.188.119:3000
+      # NextAuth v5 (Auth.js) reads AUTH_SECRET, not NEXTAUTH_SECRET. Without it at
+      # runtime, signIn throws MissingSecret -> the app error boundary shows 'Oops'.
+      AUTH_SECRET: docker-dev-nextauth-secret-minimum-32chars
+      AUTH_TRUST_HOST: "true"