feat(landing): static site + nginx image + Gitea CI (landing + macOS DMG)

- landing/: the spaceshell.ru terminal-dark landing (index.html + screenshots),
  containerized as an nginx:alpine image (Dockerfile + nginx.conf with gzip and
  asset caching, VERSION, .dockerignore).
- .gitea/workflows/build.yaml: adapted from the coddykinder pipeline to this repo.
  Path-gated jobs — `landing` builds & pushes the nginx image to the Gitea
  registry on landing changes; `dmg` builds a universal (Intel + Apple Silicon)
  .dmg via `tauri build` on app/crates changes and uploads it as an artifact;
  Max notification summarizes both. Tags build everything (release).
- DOCS/landing/spaceshell-landing.md: build brief + copy + SEO meta.

Notes: the DMG job needs a self-hosted macOS runner labelled `macos` (Tauri
can't cross-compile macOS from Linux); the DMG is unsigned until Developer ID
secrets are wired. Landing image verified locally (HTTP 200, assets served).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -0,0 +1,166 @@
+name: Build
+on:
+  push:
+    branches: [main, master]
+    tags: ["v*"]
+    paths:
+      - "landing/**"
+      - "app/**"
+      - "crates/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".gitea/workflows/build.yaml"
+
+env:
+  REGISTRY: git.realmanual.ru
+  IMAGE_PREFIX: ${{ gitea.repository }}
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  # ---------------------------------------------------------------------------
+  # Decide what changed so we don't rebuild the (slow) DMG on a landing-only edit
+  # and vice versa. Tags always build everything (release).
+  # ---------------------------------------------------------------------------
+  changes:
+    name: Detect changes
+    runs-on: ubuntu-22.04
+    container: catthehacker/ubuntu:act-latest
+    outputs:
+      landing: ${{ steps.filter.outputs.landing }}
+      app: ${{ steps.filter.outputs.app }}
+    steps:
+      - uses: actions/checkout@v3
+        with: { fetch-depth: 2 }
+      - id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            landing:
+              - 'landing/**'
+            app:
+              - 'app/**'
+              - 'crates/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+
+  # ---------------------------------------------------------------------------
+  # Landing → static nginx image pushed to the Gitea registry.
+  # ---------------------------------------------------------------------------
+  landing:
+    name: Build & push landing
+    needs: changes
+    if: needs.changes.outputs.landing == 'true' || startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-22.04
+    container: catthehacker/ubuntu:act-latest
+    outputs:
+      version: ${{ steps.version.outputs.VERSION }}
+      status: ${{ steps.build.outcome }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Read version
+        id: version
+        run: echo "VERSION=$(cat ./landing/VERSION)" >> $GITHUB_OUTPUT
+      - name: Log in to Gitea Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.TOKEN }}
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: ./landing
+          file: ./landing/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/spacesh-landing:${{ steps.version.outputs.VERSION }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/spacesh-landing:latest
+
+  # ---------------------------------------------------------------------------
+  # macOS app → universal (Intel + Apple Silicon) .dmg.
+  # REQUIRES a self-hosted macOS runner labelled `macos` — Tauri cannot
+  # cross-compile a macOS bundle from Linux. The DMG is UNSIGNED (no Developer
+  # ID secrets configured); Gatekeeper will warn on first open. To sign+notarize
+  # later, set APPLE_CERTIFICATE / APPLE_SIGNING_IDENTITY / APPLE_ID secrets and
+  # pass them through to `tauri build`.
+  # ---------------------------------------------------------------------------
+  dmg:
+    name: Build macOS DMG
+    needs: changes
+    if: needs.changes.outputs.app == 'true' || startsWith(github.ref, 'refs/tags/')
+    runs-on: macos
+    outputs:
+      version: ${{ steps.version.outputs.VERSION }}
+      status: ${{ steps.build.outcome }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Read version
+        id: version
+        run: echo "VERSION=$(node -p "require('./app/src-tauri/tauri.conf.json').version")" >> $GITHUB_OUTPUT
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Install Rust + macOS targets
+        run: |
+          if ! command -v rustup >/dev/null; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+            echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+            export PATH="$HOME/.cargo/bin:$PATH"
+          fi
+          rustup target add aarch64-apple-darwin x86_64-apple-darwin
+      - name: Install frontend deps
+        working-directory: app
+        run: npm ci
+      - name: Build universal DMG
+        id: build
+        working-directory: app
+        run: npm run tauri build -- --target universal-apple-darwin
+      - name: Collect DMG
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          cp app/src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg dist/
+          ls -lh dist
+      - name: Upload DMG artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: spacesh-dmg-${{ steps.version.outputs.VERSION }}
+          path: dist/*.dmg
+
+  # ---------------------------------------------------------------------------
+  # Summary → Max.
+  # ---------------------------------------------------------------------------
+  notify:
+    name: Notify Max
+    needs: [landing, dmg]
+    if: always()
+    runs-on: ubuntu-22.04
+    container: catthehacker/ubuntu:act-latest
+    steps:
+      - name: Compose & send summary
+        run: |
+          line_for() {
+            local name="$1" result="$2" ver="$3"
+            case "$result" in
+              success) echo "✅ $name собран (\`$ver\`)";;
+              failure) echo "❌ $name — ошибка сборки";;
+              skipped) echo "➖ $name без изменений";;
+              *)       echo "❔ $name — $result";;
+            esac
+          }
+          summary=""
+          summary="$summary"$'\n'"$(line_for spacesh-landing '${{ needs.landing.result }}' '${{ needs.landing.outputs.version }}')"
+          summary="$summary"$'\n'"$(line_for spacesh-dmg '${{ needs.dmg.result }}' '${{ needs.dmg.outputs.version }}')"
+
+          url="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}"
+          text=$(printf '**Build**%s\n\n[лог](%s)' "$summary" "$url")
+
+          curl -s -X POST "https://platform-api.max.ru/messages?chat_id=${{ secrets.MAX_CHAT_ID }}" \
+            -H "Authorization: ${{ secrets.MAX_BOT_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n --arg t "$text" '{text:$t,format:"markdown"}')"