feat: initial scaffold of CrowdSec admin webapp

Flask + htmx mini-app to list and delete CrowdSec decisions from a browser,
gated behind Authentik. Talks to host LAPI via host.docker.internal:8080
using machine JWT auth (bouncer X-Api-Key is read-only).

Gitea Actions CI/CD on push to main: runner rebuilds image and brings the
stack up via docker compose on the host (same pattern as flight-radar).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -0,0 +1,57 @@
+# ──────────────────────────────────────────────────────────────────────────────
+# CrowdSec Admin — Gitea Actions CI/CD
+#
+# Triggers on push to main. Runner builds image + brings stack up via docker
+# compose on the host. Image stays local (no registry push), same pattern as
+# flight-radar.
+#
+# PREREQUISITES (one-time):
+#   1. Host LAPI machine registered:
+#        sudo cscli machines add crowdsec-admin --password '<PW>'
+#   2. Repo secrets set in Gitea → Settings → Secrets:
+#        LAPI_MACHINE_ID=crowdsec-admin
+#        LAPI_MACHINE_PASSWORD=<PW>
+#   3. DNS: crowdsec.domverse-berlin.eu → host IP.
+#   4. Authentik wildcard forward_domain already covers *.domverse-berlin.eu.
+# ──────────────────────────────────────────────────────────────────────────────
+
+name: Deploy
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  COMPOSE_PROJECT: crowdsec-admin
+  COMPOSE_FILE: docker-compose.yml
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Write .env for compose
+        run: |
+          cat > .env <<EOF
+          LAPI_MACHINE_ID=${{ secrets.LAPI_MACHINE_ID }}
+          LAPI_MACHINE_PASSWORD=${{ secrets.LAPI_MACHINE_PASSWORD }}
+          EOF
+          chmod 600 .env
+
+      - name: Deploy with docker compose
+        run: |
+          echo "=== Deploying commit ${{ gitea.sha }} to ${{ gitea.ref_name }} ==="
+          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" up --build -d --remove-orphans
+
+      - name: Show health
+        run: |
+          sleep 3
+          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" ps
+          docker exec "$COMPOSE_PROJECT" python -c "import urllib.request; print(urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=3).read().decode())" || true
+
+      - name: Prune dangling images
+        run: docker image prune -f