feat: implement pngx-controller with Gitea CI/CD deployment

- Full FastAPI sync engine: master→replica document sync via paperless REST API
- Web UI: dashboard, replicas, logs, settings (Jinja2 + HTMX + Pico CSS)
- APScheduler background sync, SSE live log stream, Prometheus metrics
- Fernet encryption for API tokens at rest
- pngx.env credential file: written on save, pre-fills forms on load
- Dockerfile with layer-cached uv build, Python healthcheck
- docker-compose with host networking for Tailscale access
- Gitea Actions workflow: version bump, secret injection, docker compose deploy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/sync.py

@@ -0,0 +1,29 @@
+from fastapi import APIRouter
+from fastapi.responses import JSONResponse
+
+from ..sync.engine import get_progress, run_sync_cycle
+
+router = APIRouter(prefix="/api/sync", tags=["sync"])
+
+
+@router.post("")
+async def trigger_sync(replica_id: int | None = None):
+    started = await run_sync_cycle(
+        triggered_by="manual",
+        replica_id=replica_id,
+    )
+    return JSONResponse(
+        status_code=202,
+        content={"started": started, "message": "Sync triggered" if started else "Already running"},
+    )
+
+
+@router.get("/running")
+def sync_running():
+    p = get_progress()
+    return {
+        "running": p.running,
+        "phase": p.phase,
+        "docs_done": p.docs_done,
+        "docs_total": p.docs_total,
+    }